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NATIONAL FOREWORD 

This Indian Standard which is identical with ISO 13485 : 2003 'Medical devices — Ouality management 
systems — Requirements for regulatory purposes' issued by the International Organization for Standardization 
(ISO) was adopted by the Bureau of Indian Standards on the recommendation of the Hospital Planning 
Sectional Committee and approval of the Medical Equipment and Hospital Planning Division Council. 

This standard has been undertaken to consider the developments that have taken place and bring it in line 
with existing National and International practice. The committee has decided to adopt this standard under 
dual numbering system and published it as IS/ISO 13485 : 2003. 

This standard supersedes IS 1 5579:2005 'Medical devices — Ouality management systems — Requirements 
for regulatory purposes'. 

This standard specifies the requirements which are specific to organization providing medical devices 
regardless of the type of organization. The primary objective of the standard is to facilitate harmonized 
medical device regulatory requirements for quality management system. The difference in requirements 
along with explanation between ISO 9001 :2000 and ISO 13485:2003 is given in Annex B. 

The text of ISO Standard has been approved as suitable for publication as an Indian Standard without 
deviations. Certain conventions are, however, not identical to those used in Indian Standards. Attention is 
particularly drawn to the following: 

a) Wherever the words 'International Standard' appear referring to this standard, they should be read as 
'Indian Standard*. 

p) Comma {,} has been used as a decimal marker in the International Standard while in Indian Standards, 
the current practice is to use a point (.) as the decimal marker. 

In this adopted standard, reference appears to the following International Standard for which Indian Standard 
also exists. The corresponding Indian Standard which is to be substituted in its place is listed below along 
with its degree of equivalence for the edition indicated: 

International Standard Corresponding Indian Standard Degree of Equivalence 

ISO 9000:2000 Ouality management IS/ISO 9000 : 2000 Ouality Identical 

systems — Fundamentals and management systems — Funda- 

vocabulary mentals and vocabulary 

The Annexes A and B are for information only. 

For the purpose of deciding whether a particular requirement of this standard is complied with, the final 
value, observed or calculated, expressing the result of a test or analysis, shall be rounded off in 
accordance with IS 2:1960 'Rules for rounding off numerical values (revised)'. The number of significant 
places retained in the rounded off value should be the same as that of the specified value in this standard. 
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Indian Standard 

MEDICAL DEVICES — QUALITY MANAGEMENT 
SYSTEMS — REQUIREMENTS FOR 
REGULATORY PURPOSES 



1 Scope 

1.1 General 

This International Standard specifies requirements for a quality management system where an organization 
needs to demonstrate its ability to provide medical devices and related services that consistently meet customer 
requirements and regulatory requirements applicable to medical devices and related services. 

The primary objective of this International Standard is to facilitate harmonized medical device regulatory 
requirements for quality management systems. As a result, it includes some particular requirements for medical 
devices and excludes some of the requirements of ISO 900 1 that are not appropriate as regulatory requirements. 
Because of these exclusions, organizations whose quality management systems conform to this International 
Standard cannot claim conformity to ISO 9001 unless their quality management systems conform to all the 
requirements of ISO 9001 (see Annex B). 

1.2 Application 

All requirements of this International Standard are specific to organizations providing medical devices, 
regardless of the type or size of the organization. 

If regulatory requirements permit exclusions of design and development controls (see 7.3), this can be used as a 
justification for their exclusion from the quality management system. These regulations can provide alternative 
arrangements that are to be addressed in the quality management system. It is the responsibility of the 
organization to ensure that claims of conformity with this International Standard reflect exclusion of design and 
development controls [see 4.2.2 a) and 7.3]. 

If any requirement(s) in Clause 7 of this International Standard is(are) not applicable due to the nature of the 
medical device(s) for which the quality management system is applied, the organization does not need to 
include such a requirement(s) in its quality management system [see 4.2.2 a)]. 

The processes required by this International Standard, which are applicable to the medical device(s), but which 
are not performed by the organization, are the responsibility of the organization and are accounted for in the 
organization's quality management system [see 4. 1 a}]. 

In this International Standard the terms 'if appropriate" and "where appropriate" are used several times. When a 
requirement is qualified by either of these phrases, it is deemed to be "appropriate" unless the organization can 
document a justification othenvise. A requirement is considered "appropriate" if it is necessary in order for 

— the product to meet specified requirements, and/or 

— the organization to carry out corrective action. 
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2 Normative references 



The following referenced documents are indispensable for the application of this document For dated references, 
only the edition cited applies. For undated references, the latest edition of the referenced document (including 
any amendments) applies. 

ISO 9000:2000, Quality management systems — Fundamentals and vocabulary 



3 Terms and definitions 

For the purposes of this document, the terms and definitions given in ISO 9000 apply, together with the following. 

The following terms, used in this edition of ISO 13485X0 describe the supply chain, have been changed to reflect 
the vocabulary currently used: 

supplier > organization > customer 

The term "organization" replaces the term "supplier" used in ISO 13485:1996, and refers to the unit to which 
this International Standard applies. Also, the term "supplier" now replaces the term "subcontractor". 

Throughout the text of this International Standard, wherever the term "product" occurs, it can also mean "service". 

Wherever requirements are specified as applying to "medical devices", the requirements apply equally to 
related services as supplied by the organization. 

The following definitions should be regarded as generic, as definitions provided in national regulations can differ 
slightly and take precedence. 

3.1 

active implantable medical device 

active medical device which is intended to be totally or partially introduced, surgically or medically, into the human 

body or by medical intervention into a natural orifice, and which is intended to remain after the 

procedure 

3.2 

active medical device 

medical device relying for its functioning on a source of electrical energy or any source of power other than that 
directly generated by the human body or gravity 

3.3 

advisory notice 

notice issued by the organization, subsequent to delivery of the medical device, to provide supplementary 
information and/or to advise what action should be taken in 

— the use of a medical device, 

— the modification of a medical device, 

— the return of the medical device to the organization that supplied it, or 

— the destruction of a medical device 

NOTE Issue of an advisory notice might be required to comply with national or regional regulations. 
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3.4 

customer complaint 

written, electronic or oral communication that alleges deficiencies related to the identity, quality, 
durability, reliability, safety or performance of a medical device that has been placed on the market 

3.5 

implantable medical device 

medical device intended 

— to be totally or partially introduced into the human body or a natural orifice, or 

— to replace an epithelial surface or the surface of the eye, 

by surgical intervention, and which is intended to remain after the procedure for at least 30 days, and 
which can only be removed by medical or surgical intervention 

NOTE This definition appiies to implantable medical devioes other than active implantable medical devices. 

3.6 
labelling 

written, printed or graphic matter 

— affixed to a medical device or any of its containers or wrappers, or 

— accompanying a medical device, 

related to identification, technical description, and use of the medical device, but excluding shipping 
documents 

NOTE Some regional and national regulations refer to "labelling" as "information supplied by the manufacturer. " 

3.7 

medical device 

any instrument, apparatus, implement, machine, appliance, implant, in vitro reagent or calibrator, 
software, material or other similar or related article, intended by the manufacturer to be used, alone or 
in combination, for human beings for one or more of the specific purpose(s) of 

— diagnosis, prevention, monitoring, treatment or alleviation of disease, 

— diagnosis, monitoring, treatment, alleviation of or compensation for an injury, 

— investigation, replacement, modification, or support of the anatomy or of a physiological process, 

— supporting or sustaining life, 

— control of conception, 

— disinfection of medical devices, 

— providing information for medical purposes by means of in vitro examination of specimens derived 
from the human body, 

and which does not achieve its primary intended action in or on the human body by pharmacological, 
immunological or metabolic means, but which may be assisted in its function by such means. 

NOTE This definition has been developed by the Global Harmonization Task Force (GHTF). See bibliographic 
reference [15], 
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3.8 

sterile medical device 

category of medical device intended to meet thie requirements forstenlity 

NOTE We requirements for sterility of a medical device might be subject to national or regional regulations or 
standards. 



4 Quality management system 

4.1 General requirements 

The organization shall establish, document, implement and maintain a quality management system and 
maintain its effectiveness in accordance with the requirements of this International Standard. 

The organization shall 

a) identify the processes needed for the quality management system and their application throughout the 
organization (see 1.2), 

b) determine the sequence and interaction of these processes, 

c) determine criteria and methods needed to ensure that both the operation and control of these processes are 
effective, 

d) ensure the availability of resources and information necessary to support the operation and monitoring of 
these processes, 

e) monitor, measure and analyse these processes, and 

f) implement actions necessary to achieve planned results and maintain the effectiveness of these processes. 

These processes shall be managed by the organization in accordance with the requirements of this International 
Standard. 

Where an organization chooses to outsource any process that affects product conformity with requirements, the 
organization shall ensure control over such processes. Control of such outsourced processes shall be identified 
within the quality management system (see 8.5. 1). 

NOTE Processes needed for the quality management system referred to above should include processes for 
management activities, provision of resources, product realization and measurement. 

4.2 Documentation requirements 

4.2.1 General 

The quality management system documentation shall include 

a) documented statements of a quality policy and quality objectives, 

b) a quality manual, 

c) documented procedures required by this International Standard, 

d) documents needed by the organization to ensure the effective planning, operation and control of its 
processes. 
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e) records required by this International Standard (see 4.2.4), and 

f) any other documentation specified by national or regional regulations. 

Where this International Standard specifies that a requirement, procedure, activity or special 
arrangement be 'documented", it shall, in addition, be implemented and maintained. 

For each type or model of medical device, the organization shall establish and maintain a file either 
containing or identifying documents defining product specifications and quality management system 
requirements (see 4.2.3), These documents shall define the complete manufacturing process and, if 
applicable, installation and servicing. 

NOTE 1 The extent of the quality management system documentation can differ from one organization to another due to 

a) the size of the organization and type of activities, 

b) the complexity of processes and their interactions, and 

c) the competence of personnel. 

NOTE 2 The documentation can be in any form or type of medium. 

4.2.2 Quality manual 

The organization shall establish and maintain a quality manual that includes 

a) the scope of the quality management system, including details of and justification for any 
exclusion and/or non-application (see 1.2), 

b) the documented procedures established for the quality management system, or reference to 
themr and 

c) a description of the interaction between the processes of the quality management system. 

The quality manual shall outline the structure of the documentation used in the quality management 
system. 

4.2.3 Control of documents 

Documents required by the quality management system shall be controlled. Records are a special 
type of document and shall be controlled according to the requirements given in 4.2.4. 

A documented procedure snail be established to define the controls needed 

a) to review and approve documents for adequacy prior to issue, 

b) to review and update as necessary and re-approve documents, 

c) to ensure that changes and the current revision status of documents are identified, 

d) to ensure that relevant versions of applicable documents are available at points of use, 

e) to ensure that documents remain legible and readily identifiable, 

f) to ensure that documents of external origin are identified and their distribution controlled, and 

g) to prevent the unintended use of obsolete documents, and to apply suitable identification to them 
if they are retained for any purpose. 
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The organization shall ensure that changes to documents are reviewed and approved either by the original 
approving function or another designated function which has access to pertinent background information upon 
which to base its decisions. 

The organization shall define the period for which at least one copy of obsolete controlled documents shall be 
retained. This period shall ensure that documents to which medical devices have been manufactured and tested 
are available for at hast the lifetime of the medical device as defined by the organization, but not less than the 
retention period of any resulting record (see 4.2.4), or as specified by relevant regulatory requirements. 

4.2.4 Control of records 

Records shall be established and maintained to provide evidence of conformity to requirements and of the 
effective operation of the quality management system. Records shall remain legible, readily identifiable and 
retrievable. A documented procedure shall be established to define the controls needed for the identification, 
storage, protection, retrieval, retention time and disposition of records. 

7776 organization shall retain the records for a period of time at least equivalent to the lifetime of the medical 
device as defined by the organization, but not less than two years from the date of product release by the 
organization or as specified by relevant regulatory requirements. 



5 Management responsibility 

5.1 lUlanagement commitment 

Top management shall provide evidence of its commitment to the development and implementation of the quality 
management system and maintaining its effectiveness by 

a) communicating to the organization the importance of meeting customer as well as statutory and regulatory 
requirements, 

b) establishing the quality policy, 

c) ensuring that quality objectives are established, 

d) conducting management reviews, and 

e) ensuring the availability of resources. 

NOTE For the purposes of this International Standard, statutory requirements are limited to the safety and performance of 
the medical device only. 

5.2 Customer focus 

Top management shall ensure that customer requirements are determined and are met (see 7.2. 1 and 8.2. 1). 

5.3 Quality policy 

Top management shall ensure that the quality policy 

a) is appropriate to the purpose of the organization. 

b) includes a commitment to comply with requirements and to maintain the effectiveness of the quality 
management system, 

c) provides a framework for establishing and reviewing quality objectives. 
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d) is communicated and understood witliin tlie organization, and 

e) is reviewed for continuing suitability. 

5.4 Planning 

5.4.1 Quality objectives 

Top management sliall ensure tliat quality objectives, including those needed to meet requirements 
for product (see 7.1 a) 3, are established at relevant functions and levels within the organization. The 
quality objectives shall be measurable and consistent with the quality policy. 

5.4.2 Quality management system planning 

Top management shall ensure that 

a) the planning of the quality management system is carried out in order to meet the requirements 
given in 4.1 , as well as the quality objectives, and 

b) the integrity of the quality management system is maintained when changes to the quality 
management system are planned and implemented. 

5.5 Responsibility, authority and communication 

5.5.1 Responsibility and authority 

Top management shall ensure that responsibilities and authorities are defined, documented and 
communicated within the organization. 

Top management' shall establish the interrelation of all personnel who manage, perform and verify 
won\ affecting Quality, and shall ensure the independence and authority necessary to perform these 
tasks, 

NOTE National or regional regulations might require the nomination of specific persons as 
responsible for activities related to monitoring experience from the post-production stage and 
reporting adverse events (see 8-2, 1 and 8.5. 1). 

5.5.2 Management representative 

Top management shall appoint a member of management who, irrespective of other responsibilities, 
shall have responsibility and authority that includes 

a) ensuring that processes needed for the quality management system are established, 
implemented and maintained, 

b) reporting to top management on the performance of the quality management system and any 
need for improvement (see 8.5), and 

c) ensuring the promotion of awareness of regulatory and customer requirements throughout the 
organization. 

NOTE The responsibility of a management representative can include liaison with external parties on 
matters relating to the quality management system. 

5.5.3 Internal communication 

Top management shall ensure that appropriate communication processes are established within the 
organization and that communication takes place regarding the effectiveness of the quality 
management system. 
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5.6 Management review 

5.6.1 General 

Top management shall review the organization's quality management system, at planned intervals, to 
ensure its continuing suitability, adequacy and effectiveness. This review shall include assessing 
opportunities for improvement and the need for changes to the quality management system, including 
the quality policy and quality objectives. 

Records from management reviews shall be maintained (see 4.2.4). 

5.6.2 Review input 

The input to management review shall include information on 

a) results of audits, 

b) customer feedback, 

c) process performance and product conformity, 

d) status of preventive and corrective actions, 

e) follow-up actions from previous management reviews, 

f) changes that could affect the quality management system, 

g) recommendations for improvement, and 
h) new or revised regulatory requirements. 

5.6.3 Review output 

The output from the management review shall include any decisions and actions related to 

a) improvements needed to maintain tiie effectiveness of thie quality management system and its 
processes, 

b) improvement of product related to customer requirements, and 

c) resource needs. 

6 Resource management 

6.1 Provision of resources 

The organization shall determine and provide the resources needed 

a) to implement thie quality management system and to maintain its effectiveness, and 

b) to meet regulatory and customer requirements. 
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6.2 Human resources 

6.2.1 General 

Personnel performing work affecting product quality shall be competent on the basis of appropriate 
education, training, skills and experience. 

6.2.2 Competence, awareness and training 

The organization shall 

a) determine the necessary competence for personnel performing work affecting product quality, 

b) provide training or take other actions to satisfy these needs. 

c) evaluate the effectiveness of the actions taken, 

d) ensure that its personnel are aware of the relevance and importance of their activities and how 
they contribute to the achievement of the quality objectives, and 

e) maintain appropriate records of education, training, skills and experience (see 4.2.4). 

NOTE National or regional regulations might require the organization to establish documented procedures for 
identifying training needs. 

6.3 Infrastructures 

The organization shall determine, provide and maintain the infrastructure needed to achieve 
conformity to product requirements. Infrastructure includes, as applicable 

a) buildings, workspace and associated utilities, 

b) process equipment (both hardware and software), and 

c) supporting services (such as transport or communication). 

The organization shall establish documented requirements for maintenance activities, including their 
frequency, when such activities or lack thereof can affect product quality. 

Records of such maintenance shall be maintained (see 4.2.4). 

6.4 Work environment 

The organization shall determine and manage the work environment needed to achieve conformity to 
product requirements. 

The following requirements shall apply. 

a) The organization shall establish documented requirements for health, cleanliness and clothing of 
personnel if contact between such personnel and the product or work environment could 
adversely affect the quality of the product (see 7.5. 1.2. 1). 

b) If work environment conditions can have an adverse effect on product quality, the organization 
shall establish documented requirements for the work environment conditions and documented 
procedures or work instructions to monitor and control these work environment conditions (see 
7.5.1.21). 

c) The organization shall ensure that all personnel who are required to work temporarily under 
special environmental conditions within the work environment are appropriately trained or 
supervised by a trained person [see 6.2.2 b)]. 

d) If appropriate, special arrangements shall be established and documented for the control of 
contaminated or potentially contaminated product in order to prevent contamination of other 
product, the work environment or personnel (see 7.5.3. 1). 



IS/ISO 13485: 2003 



7 Product realization 

7.1 Planning of product realization 

The organization sliall plan and develop the processes needed for product realization. Planning of product 
realization shall be consistent with the requirements of the other processes of the quality management system 
{see 4.1). 

In planning product realization, the organization shall determine the following, as appropriate: 

a) quality objectives and requirements for the product; 

h) the need to establish processes, documents, and provide resources specific to the product; 

c) required verification, validation, monitoring, inspection and test activities specific to the product and the 
criteria for product acceptance; 

d) records needed to provide evidence that the realization processes and resulting product meet requirements 
(see 4.2.4). 

The output of this planning shall be in a form suitable for the organization's method of operations. 

The organization shall establish documented requirements for risk management throughout product realization. 
Records arising from risk management shall be maintained (see 4.2.4). 

NOTE 1 A document specifying the processes of the quality management system (including the product realization processes) 
and the resources to be applied to a specific product, project or contract, can be referred to as a quality plan. 

NOTE 2 The organization may also apply the requirements given in -7-3 to the development of product realization processes. 

NOTE 3 See ISO 14971 for guidance related to risk management. 

7.2 Customer-related processes 

7.2.1 Determination of requirements related to the product 
The organization shall determine 

a) requirements specified by the customer, including the requirements for delivery and post-delivery 
activities, 

b) requirements not stated by the customer but necessary for specified or intended use, where known, 

c) statutory and regulatory requirements related to the product, and 

d) any additional requirements determined by the organization. 

7.2.2 Review of requirements related to the product 

The organization shall review the requirements related to the product. This review shall be conducted prior to the 
organization's commitment to supply a product to the customer (e.g. submission offenders, acceptance of 
contracts or orders, acceptance of changes to contracts or orders) and shall ensure that 

a) product requirements are defined and documented, 

b) contract or order requirements differing from those previously expressed are resolved, and 

c) the organization has the ability to meet the defined requirements. 
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Records of the results of the review and actions arising from the review shall be maintained (see 4.2.4). 

Where the customer provides no documented statement of requirement, the customer requirements shall be 
confirmed by the organization before acceptance. 

Where product requirements are changed, the organization shall ensure that relevant documents are amended 
and that relevant personnel are made aware of the changed requirements. 

NOTE In some situations, such as internet sates, a formal review is impractical for each order. Instead the review can cover 
relevant product information such as catalogues or advertising material. 

7.2.3 Customer communication 

The organization shall determine and implement effective arrangements for communicating with customers in 
relation to 

a) product information, 

b) enquiries, contracts or order handling, including amendments, 

c) customer feedback, including customer complaints (see 8.2. 1), and 

d) advisory notices (see 8.5. 1). 

7.3 Design and development 

7.3.1 Design and deveiopment planning 

Thie organization shiall establishi documented procedures for design and development 
The organization shall plan and control the design and development of product. 
During the design and development planning, the organization shall determine 

a) the design and development stages, 

b) the review, verification, validation and design transfer activities (see Note) that are appropriate at each 
design and development stage, and 

c) the responsibilities and authorities for design and development. 

The organization shall manage the interfaces between different groups involved in design and development to 
ensure effective communication and clear assignment of responsibility. 

Planning output shall be documented, and updated as appropriate, as the design and development progresses 
(see 4.2.3). 

NOTE Design transfer activities during the design and development process ensure that design and development outputs 
are verified as suitable for manufacturing before becoming final production specifications. 

7.3.2 Design and development inputs 

inputs relating to product requirements shall be determined and records maintained (see 4.2.4). These inputs 
shall include 

a) functional, performance and safety requirements, according to the intended use, 

b) applicable statutory and regulatory requirements. 
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c) where applicable, information derived from previous similar designs, 

d) other requirements essential for design and development, and 

e) output(s) of risk management (see 7. 1). 

These inputs siiall be reviewed for adequacy and approved. 

Requirements shall be complete, unambiguous and not in conflict with each other. 

7.3.3 Design and development outputs 

The outputs of design and development shall be provided in a form that enables verification against 
the design and development input and shall be approved prior to release. 

Design and development outputs shall 

a) meet the input requirements for design and development, 

b) provide appropriate information for purchasing, production and for service provision, 

c) contain or reference product acceptance criteria, and 

d) specify the characteristics of the product that are essential for its safe and proper 
use. Records of thie design and development outputs shiall be maintained (see 4.2.4). 

NOTE Records of design and development outputs can include specifications, manufacturing procedures, 
engineering drawings, and engineering or research logbooks. 

7.3.4 Design and development review 

At suitable stages, systematic reviews of design and development shall be performed in accordance 
with planned arrangements (see 7.3.1) 

a) to evaluate the ability of the results of design and development to meet requirements, and 

b) to identify any problems and propose necessary actions. 

Participants in such reviews shall include representatives of functions concerned with the design and 
development stage(s) being reviewed, as well as other specialist personnel (see 5.5. 1 and 6.2. 1). 

Records of the results of the reviews and any necessary actions shall be maintained (see 4.2.4). 

7.3.5 Design and development verification 

Verification shall be performed in accordance with planned arrangements (see 7.3.1) to ensure that 
the design and development outputs have met the design and development input requirements. 
Records of the results of the verification and any necessary actions shall be maintained (see 4.2.4). 

7.3.6 Design and development validation 

Design and development validation shall be performed in accordance with planned arrangements 
(see 7.3.1) to ensure, that the resulting product is capable of meeting the requirements for the 
specified application or intended use. Validation shall be completed prior to the delivery or 
implementation of the product (see Note 1). 

Records of the results of validation and any necessary actions shall be maintained {see 4.2.4). 
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As part of design and development validation, the organization shall perform clinical evaluations 
and/or evaluation of performance of the medical device, as required by national or regional 
regulations (see Note 2). 

NOTE 1 1f a medical device can only be validated following assembly and installation at point of use, delivery is 
not considered to be complete until tfie product has been formally transferred to tfie customer. 

NOTE 2 Provision of the medical device for purposes of clinical evaluations and/or evaluation of performance is 
not considered to be delivery. 

7.3.7 Control of design and development changes 

Design and development changes shall be identified and records maintained. The changes shall be 
reviewed, verified and validated, as appropriate, and approved before implementation. The review of 
design and development changes shall include evaluation of the effect of the changes on constituent 
parts and product already delivered. 

Records of the results of the review of changes and any necessary actions shall be maintained (see 
4.2.4). 

7.4 Purchasing 

7.4.1 Purchasing process 

The organization shall establish documented procedures to ensure that purchased product conforms 
to specified purchase requirements. 

The type and extent of control applied to the supplier and the purchased product shall be dependent 
upon the effect of the purchased product on subsequent product realization or the final product. 

The organization shall evaluate and select suppliers based on their ability to supply product in 
accordance with the organization's requirements. Criteria for selection, evaluation and re-evaluation 
shall be established. Records of the results of evaluations and any necessary actions arising from the 
evaluation shall be maintained (see 4.2.4). 

7.4.2 Purchasing Information 

Purchasing information shall describe the product to be purchased, including where appropriate 

a) requirements for approval of product, procedures, processes and equipment, 

b) requirements for qualification of personnel, and 

c) quality management system requirements. 

The organization shall ensure the adequacy of specified purchase requirements prior to their 
communication to the supplier. 

To the extent required for traceability given in 7.5.3.2, the organization shall maintain relevant 
purchasing information, i.e. documents (see 4.2.3) and records (see 4.2.4), 

7.4.3 Verification of purchased product 

The organization shall establish and implement the inspection or other activities necessary for 
ensuring that purchased product meets specified purchase requirements. 

Where the organization or its customer intends to perform verification at the supplier's premises, the 
organization shall state the intended verification arrangements and method of product release in the 
purchasing information. 

Records of the verification shall be maintained (see 4.2.4). 
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7.5 Production and service provision 

7.5.1 Controi of production and service provision 

7.5. 1. 1 General requirements 

The organization sliall plan and carry out production and service provision under controlled conditions. Controlled 
conditions shall include, as applicable 

a) the availability of information that describes the. characteristics of the product, 

b) the availability of documented procedures, documented requirements, work instructions, and reference 
materials and reference measurement procedures as necessary, 

c) the use of suitable equipment, 

d) the availability and use of monitoring and measuring devices, 

e) the implementation of monitoring and measurement, 

f) the implementation of release, delivery and post-delivery activities, and 

g) the implementation of defined operations for labelling and packaging. 

The organization shall establish and maintain a record (see 4.2.4) for each batch of medical devices that provides 
traceability to the extent specified in 7.5.3 and identifies the amount manufactured and amount approved for 
distribution. The batch record shall be verified and approved. ' 

NO TE A batch can be a single medical device. 

7.5. 1.2 Control of production and service provision — Specific requirements 

7.5. 1.2. 1 Cleanliness of product and contamination control 

The organization shall establish documented requirements for cleanliness of product if 

a) product is cleaned by the organization prior to sterilization and/or its use, or 

b) product is supplied non-sterile to be subjected to a cleaning process prior to sterilization and/or its use, or 

c) product is supplied to-be used non-sterile and its cleanliness is of significance in use, or 

d) process agents are to be removed from product during manufacture. 

If product is cleaned in accordance with a) or b) above, the requirements contained in 6.4 a) and 6.4 b) do not 
apply prior to the cleaning process. 

7.5.1.2.2 Installation activities 

If appropriate, the organization shall establish documented requirements which contain acceptance criteria for 
installing and verifying the installation of the medical device. 

if the agreed customer requirements allow installation to be performed other than by the organization or its 
authorized agent, the organization shall provide documented requirements for installation and verification. 

Records of installation and verification performed by the organization or its authorized agent shall be maintained 
(see 4.2.4). 
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7.5. 1.2.3 Servicing activities 

If servicing is a specified requirement, thie organization shiall establish: documented procedures, work instructions 
and reference materials and reference measurement procedures, as necessary, for performing servicing activities 
and verifying that they meet the specified requirements. 

Records of servicing activities carried out by the organization shall be maintained (see 4,2.4). 

NOTE Servicing can include, for example, repair and maintenance. 

7.5. 1.3 Particular requirements for sterile medical devices 

The organization shall maintain records of the process parameters for the sterilization process which was used 
for each sterilization batch (see 4.2.4). Sterilization records shall be traceable to each production batch of 
medical devices (see 7.5. 1. 1). 

7.5.2 Validation of processes for production and service provision 

7.5.2. 1 General requirements 

The organization shall validate any processes for production and service provision where the resulting output 
cannot be verified by subsequent monitoring or measurement. This includes any processes where deficiencies 
become apparent only after the product is in use or the service has been delivered. 

Validation shall demonstrate the ability of these processes to achieve planned results. 

The organization shall establish arrangements for these processes including, as applicable 

a) defined criteria for review and approval of the processes, 

b) approval of equipment and qualification of personnel, 

c) use of specific methods and procedures, 

d) requirements for records (see 4.2.4), and 

e) revalidation. 

The organization shall establish documented procedures for the validation of the application of computer software 
(and changes to such software and/or its application) for production and service provision that affect the ability of 
me product to conform to specified requirements. Such software applications shall be validated prior to initial use. 

Records of validation shall be maintained (see 4.2.4) 

7.5.2.2 Particular requirements for sterile medical devices 

The organization shall establish documented procedures for the validation of sterilization processes. Sterilization 
processes shall be validated prior to initial use. 

Records of validation of each sterilization process shall be maintained (see 4.2.4). 
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7.5.3 Identification and traceability 

7.5.3. 1 Identification 

The organization siiall identify the product by suitable means throughout product realization, and shall 
establish documented procedures for such product identification. 

The organization shall establish documented procedures to ensure that medical devices retimed to the 
organization are identified and distinguished from conforming product [see 6.4 d)]. 

7.5.3.2 Traceabiiity 

7.5.3.2.1 General 

The organization shall establish documented procedures for traceability. Such procedures shall define 
the extent of product traceability and the records required (see 4.2.4, 8.3 and 8.5). 

Where traceability is a requirement, tlie organization siiall control and record the unique identification 
of the product (see 4.2.4). 

NOTE Configuration management is a means by which identification and traceability can be maintained. 

7.5.3.2.2 Particular requirements for active implantable medical devices and implantable medical 
devices 

In defining the records required for traceability, the organization shall include records of all components, 
materials and work environment conditions, if these could cause the medical device not to satisfy its 
specified requirements. 

The organization shall require that its agents or distributors maintain records of the distribution of 
medical devices to allow traceability and that such record are available for inspection. 

Records of the name and address of the shipping package consignee shall be maintained (see 4.2.4). 

7.5.3.3 Status identification 

The organization shall identify the product status with respect to monitoring and measurement 
requirements. 

The identification of product status shall be maintained throughout production, storage, installation and 
servicing of the product to ensure that only product that has passed the required inspections and tests 
(or released under an authorized concession) is dispatched, used or installed. 

7.5.4 Customer property 

The organization shall exercise care with customer property while it is under the organization's control 
or being used by the organization. The organization shall identify, verify, protect and safeguard 
customer property provided for use or incorporation into the product. If any customer property is lost, 
damaged or otherwise found to be unsuitable for use, this shad be reported to the customer and 
records maintained (see 4.2.4). 

NOTE Customer property can include intellectual property or confidential health information. 

7.5.5 Preservation of product 

The organization shall establish documented procedures or documented work instructions for 
preserving the conformity of product during internal processing and delivery to the intended 
destination. 
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This preservation sliall include identification, handling, packaging, storage and protection. Preservation shall 
also apply to the constituent parts of a product. 

The organization siiall establish documented procedures or documented worl< instructions for the control of 
product with a limited shelf-life or requiring special storage conditions. Such special storage conditions shall be 
controlled and recorded (see 4.2.4). 

7.6 Control of monitoring and measuring devices 

The organization shall determine the monitoring and measurement to be undertaken and the monitoring and 
measuring devices needed to provide evidence of conformity of product to determined requirements (see 7.2.1 ). 

The organization shall establish documented procedures to ensure that monitoring and measurement can be 
carried out and are carried out in a manner that is consistent with the monitoring and measurement 
requirements. 

Where necessary to ensure valid results, measuring equipment shall 

a) be calibrated or verified at specified intervals, or prior to use, against measurement standards traceable to 
international or national measurement standards; where no such standards exist, the basis used for 
calibration or verification shall be recorded; 

b) be adjusted or re-adjusted as necessary; 

c) be identified to enable the calibration status to be determined; 

d) be safeguarded from adjustments that would invalidate the measurement result; 

e) be protected from damage and deterioration during handling, maintenance and storage. 

In addition, the Organization shall assess and record the validity of the previous measuring results when the 
equipment is found not to conform to requirements. The organization shall take appropriate action on the 
equipment and any product affected. Records of the results of calibration and verification shall be maintained 
(see 4.2.4). 

When used in the monitoring and measurement of specified requirements, the ability of computer software to 
satisfy the intended application shall be confirmed. This shall be undertaken prior to initial use and reconfirmed 
as necessary. 

NOTE See ISO 10012 for guidance related to measurement management systems. 

8 Measurement, analysis and improvement 

8.1 General 

The organization shall plan and implement the monitoring, measurement, analysis and improvement processes 
needed 

a) to demonstrate conformity of the product, 

b) to ensure conformity of the quality management system, and 

c) to maintain the effectiveness of the quality management system. 

This shall include determination of applicable methods, including statistical techniques, and the extent of their 
use. 

NOTE National or regional regulations might require documented procedures for implementation and control of the 

application of statistical techniques. 
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8.2 Monitoring and measurement 

8.2.1 Feedback 

As one of the measurements of thie performance of the quality management system, the organization shall 
monitor information relating to whether the organization has met customer requirements. 

The methods for obtaining and using this information shall be determined. 

The organization shall establish a documented procedure for a feedback system [see 7.2.3 c)] to provide 
early warning of quality problems and for input into the corrective and preventive action processes (see 8.5.2 
and 8.5.3). 

If national or regional regulations require the organization to gain experience from the post-production phase, 
the review of this experience shall form part of the feedback system (see 8.5. 1). 

8.2.2 Internal audit 

The organization shall conduct internal audits at planned intervals to determine whether the quality management 
system 

a) conforms to the planned arrangements (see 7.1), to the requirements of this International Standard and to 
the quality management system requirements established by the organization, and 

b) is effectively implemented and maintained. 

An audit programme shall be planned, taking into consideration the status and importance of the processes and 
areas to be audited, as well as the results of previous audits. The audit criteria, scope, frequency and methods 
shall be defined. Selection of auditors and conduct of audits shall ensure objectivity and impartiality of the audit 
process. Auditors shall not audit their own work. 

The responsibilities and requirements for planning and conducting audits, and for reporting results and 
maintaining records (see 4.2.4) shall be defined in a documented procedure. 

The management responsible for the area being audited shall ensure that actions are taken without undue delay 
to eliminate detected nonconformities and their causes. Follow-up activities shall include the verification of the 
actions taken and the reporting of verification results (see 8.5.2). 

NOTE See ISO 19011 for guidance related to quality auditing. 

8.2.3 Monitoring and measurement of processes 

The organization shall apply suitable methods for monitoring and, where applicable, measurement of the quality 
management system processes. These methods shall demonstrate the ability of the processes to achieve 
planned results. When planned results are not achieved, correction and corrective action shall be taken, as 
appropriate, to ensure conformity of the product. 

8.2.4 Monitoring and measurement of product 
8. 2. 4. 1 General requirements 

The organization shall monitor and measure the characteristics of the product to verify that product requirements 
have been met. This shall be carried out at appropriate stages of the product realization process in accordance 
with the planned arrangements (see 7. 1) and documented procedures (see 7.5. 1. 1). 

Evidence of conformity with the acceptance criteria shall be maintained. Records shall indicate the person(s) 
authorizing release of product (see 4.2.4). 
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Product release and service delivery shall not proceed until the planned arrangements (see 7. 1) have 
been satisfactorily completed. 

8.2.4.2 Particular requirement for active impiantable medical devices and implantable 
medical devices 

The organization shall record (see 4.2.4) the identity of personnel performing any inspection or testing. 

8.3 Control of nonconforming product 

The organization shall ensure that product which does not conform to product requirements is identified 
and controlled to prevent its unintended use or delivery. The controls and related responsibilities and 
authorities for dealing with nonconforming product shall be defined in a documented procedure. 

The organization shall deal with nonconforming product by one or more of the following ways: 

a) by taking action to eliminate the detected nonconformity; 

b) by authorizing its use, release or acceptance under concession; 

c) by taking action to preclude its original intended use or application. 

The organization shall ensure that nonconforming product is accepted by concession only if regulatory 
requirements are met Records of the identity of the person(s) authorizing the concession shall be 
maintained (see 4.2.4). 

Records of the nature of nonconformities and any subsequent actions taken, including concessions 
obtained, shall be maintained (see 4.2.4). 

When nonconforming product is corrected it shall be subject to re-verification to demonstrate conformity to 
the requirements. 

When nonconforming product is detected after delivery or use has started, the organization shall take 
action appropriate to the effects, or potential effects, of the nonconformity. 

If product needs to be reworked (one or more times), the organization shall document the rework process 
in a work instruction that has undergone the same authorization and approval procedure as the original 
work instruction. Prior to authorization and approval of the work instruction, a determination of any adverse 
effect of the rework upon product shall be made and documented (see 4.2.3 and 7.5. 1). 

8.4 Analysis of data 

The organization shall establish documented procedures to determine collect and analyse appropriate 
data to demonstrate the suitability and effectiveness of the quality management system and to evaluate if 
improvement of the effectiveness of the quality management system can be made. 

This shall include data generated as a result of monitoring and measurement and from other relevant 
sources. The analysis of data shall provide information relating to 

a) feedback (see 8.2. 1), 

b) conformity to product requirements (see 7.2.1 ), 

c) characteristics and trends of processes and products including opportunities for preventive action, 
and 

d) suppliers. 

Records of the results of the analysis of data shall be maintained (see 4.2.4). 
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8.5 Improvement 

8.5.1 General 

The organization shall identify and implement any changes necessary to ensure and maintain the continued 
suitability and effectiveness of the quality management system through the use of the quality policy, quality 
objectives, audit results, analysis of data, corrective and preventive actions and management review. 

The organization shall establish documented procedures for the issue and implementation of advisory notices. 
These procedures shall be capable of being implemented at any time. 

Records of ail customer complaint investigations shall be maintained (see 4.2. 4). If investigation determines that 
the activities outside the organization contributed to the customer complaint, relevant information shall be 
exchanged between the organizations involved (see 4. 1). 

If any customer complaint is not followed by corrective and/or preventive action, the reason shall be authorized 
(see 5.5. 1) and recorded (see 4.2.4). 

If national or regional regulations require notification of adverse events that meet specified reporting criteria, the 
organization shall establish documented procedures to such notification to regulatory authorities. 

8.5.2 Corrective action 

The organization sliall take action to eliminate the cause of nonconformities in order to prevent recurrence. 
Corrective actions shall be appropriate to the effects of the nonconformities encountered. 

A documented procedure shall be established to define requirements for 

a) reviewing nonconformities (including customer complaints), 

b) determining the causes of nonconformities, 

c) evaluating the need for action to ensure that nonconformities do not recur, 

d) determining and implementing action needed, including, if appropriate, updating documentation (see 4.2), 

e) recording of the results of any investigation and of action taken (see 4.2.4), and 

f) reviewing the corrective action taken and its effectiveness. 

8.5.3 Preventive action 

The organization shall determine action to eliminate the causes of potential nonconformities in order to prevent 
their occurrence. Preventive actions shall be appropriate to the effects of the potential problems. 

A documented procedure shall be established to define requirements for 

a) determining potential nonconformities and their causes, 

b) evaluating the need for action to prevent occurrence of nonconformities, 

c) determining and implementing action needed, 

d) recording of the results of any investigations and of action taken (see 4.2.4), and 

e) reviewing preventive action taken and its effectiveness. 
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Annex A 

(informative) 

Correspondence between ISO 13485:2003 and ISO 13485:1996 



Table A.1 — Correspondence between ISO 13485:1996 and ISO 13485:2003 



15013485:1996 


13013485:2003 


1 Scope 


1 


2 Normative reference 


2 


3 Definitions 


3 


4 Quality system requirements [title only] 




4.1 Management responsibility [title only] 

4.1.1 Quality policy 

4.1 .2 Organization [title only] 

4.1 .2.1 Responsibility and authority 

4.1.2.2 Resources 

4. 1 .2.3 Management representative 

4.1.3 Management review 


5.1 +5.3 + 5.4.1 

5.5.1 

6.1 +6.2.1 

5.5.2 

5.6.1 +8.5.1 


4.2 Quality system [title only] 

4.2.1 General 

4.2.2 Quality system procedures 

4.2.3 Quality planning 


4.1 +4.2.2 
4.2.1 
5,4.2 + 7.1 


4.3 Contract review [title only] 

4.3.1 General [title only] 

4.3.2 Review 

4.3.3 Amendment to a contract 

4.3.4 Records 


5.2 + 7.2.1+7.2.2 + 7.2.3 

7.2.2 

7.2.2 


4.4 Design control [title only]' 

4.4.1 General [title only] 

4.4.2 Design and development planning 

4.4.3 Organizational and technical interfaces 

4.4.4 Design input 

4.4.5 Design output 

4.4.6 Design review 

4.4.7 Design verification 

4.4.8 Design validation 

4.4.9 Design changes 


7.3.1 

7.3.1 

7.2.1 +7.3.2 

7.3.3 

7.3.4 

7.3.5 

7.3.6 

7.3.7 


4.5 Document and data control [title only] 

4.5.1 General 

4.5.2 Document and data approval and issue 

4.5.3 Document and data changes 


4.2.3 
4.2.3 
4.2.3 
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Table A.1 (continued) 



15013485:1996 


15013485:2003 


4,6 Purchasing [title only] 

4.6.1 General [title only] 

4.6.2 Evaluation of subcontractors 

4.6.3 Purchasing data 

4.6.4 Verification of purchased product 


7.4.1 
7.4.2 
7.4.3 


4.7 Control of customer-supplied product 


7.5.4 


4.8 Product identification and traceability 


7.5.3 


4.9 Process control 


6.3 + 6.4 + 7.5.1 +7.5.2 


4.10 Inspection and testing [title only] 

4.10.1 General 

4.1 0.2 Receiving inspection and testing 

4.10.3 In-process inspection and testing 

4.10.4 Final inspection and testing 

4.10.5 Inspection and test records 


7.1 +8.1 

7.4.3 + 8.2.4 

8.2.4 

8.2.4 

7.5.3 + 8.2.4 


4.1 1 Control of inspection, measuring and test equipment [title only] 

4.11.1 General 

4.1 1 .2 Control procedure 


7.6 
7.6 


4.12 Inspection and test status 


7.5.3 


4.13 Control of nonconforming product [title only] 

4.13.1 General 

4.1 3.2 Review and disposition of nonconforming product 


8.3 

8.3 


4.14 Corrective and preventive action [title only] 

4.14.1 General 

4.14.2 Corrective action 

4.14.3 Preventive action 


8.5.2 + 8.5.3 

8.5.2 

8.5.3 


4.15 Handling, storage, packaging, preservation & delivery [title only] 

4.15.1 General 

4.15.2 Handling 

4.15.3 Storage 

4.15.4 Packaging 

4.15.5 Preservation 

4.15.6 Delivery 


6.4 

7.5.5 

7.5.5 

7.5.5 

7.5.5 

7.5.1 


4.16 Control of quality records 


4.2.4 


4.17 Internal quality audits 


8.2.2 + 8.2.3 


4.18 Training 


6.2.2 


4.19 Servicing 


7.5.1 


4.20 Statistical techniques [title only] 

4.20.1 Identification of need 

4.20.2 Procedures 


8.1 +8.2.3 + 8.2.4 + 8.4 
8.1 +8.2.3 + 8.2.4 + 8.4 
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Table A.2 — Correspondence between ISO 13485:2003 and ISO 13485:1996 



13013485:2003 


13013485:1996 


1 Scope 


1 


1.1 General 




1 .2 Application 




2 Normative reference 


2 


3 Terms and definitions 


3 


4 Quality management system [title only] 




4.1 General requirements 


4.2.1 


4.2 Documentation requirements [title only] 

4.2.1 General 

4.2.2 Quality manual 

4.2.3 Control of documents 

4.2.4 Control of records 


4.2.2 

4.2.1 

4.5.1 +4.5.2 + 4.5.3 

4.16 


5 Management responsibility [title only] 




5.1 Management commitment 


4.1.1 


5,2 Customer focus 


4.3.2 


5.3 Quality policy 


4.1.1 


5.4 Planning [title only] 


- 


5.4.1 Quality objectives 

5.4.2 Quality management system planning 


4.1.1 
4.2.3 


5.5 Responsibility, authority and communication [titfe only] 

5.5.1 Responsibility and authority 

5.5.2 Management representative 

5.5.3 Internal communication 


4.1.2.1 
4.1.2.3 


5.6 Management review [title only] 




5.6.1 General 

5.6.2 Review input 

5.6.3 Review output 


4.1.3 


6 Resource management [title only] 




6.1 Provision of resources 


4.1.2.2 


6.2 Human resources [title only] 

6.2.1 General 

6.2.2 Competence, awareness and training 


4.1.2.2 
4.18 


6.3 Infrastructure 


4.9 


6.4 Work environment 


4.9 + 4.15.1 


7 Product realization [title only] 




7.1 Planning of product realization 


4.2.3 + 4.10.1 
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Table A.2 (continued) 



18013485:2003 


15013485:1996 


7.2 Customer-related processes [title only] 

7.2.1 Determination of requirements related to the product 

7.2.2 Review of requirements related to the product 

7.2.3 Customer communication 


4.3.2 + 4.4.4 
4.3.2 + 4.3.3+4.3.4 
4.3.2 


7,3 Design and development [title only] 

7.3.1 Design and development planning 

7.3.2 Design and development inputs 

7.3.3 Design and development outputs 

7.3.4 Design and development review 

7.3.5 Design and development verification 

7.3.6 Design and development validation 

7.3.7 Control of design and development changes 


4.4.2 + 4.4.3 

4.4.4 

4.4.5 

4.4.6 

4.4.7 

4.4.8 

4.4.9 


7.4 Purchasing [title only] 




7.4.1 Purchasing process 

7.4.2 Purchasing information 

7.4.3 Verification of purchased product 


4.6.2 
4.6.3 
4.6.4 + 4.10.2 


7.5 Production and service provision [title only] 




7.5.1 Control of production and service provision 

7.5.2 Validation of processes for production and service provision 

7.5.3 Identification and traceability 

7.5.4 Customer property 

7.5.5 Preservation of product 


4.9 + 4.15.6 + 4.19 

4.9 

4.8 + 4.10.5 + 4.12 

4.7 

4.15.2 + 4.15.3 + 4.15.4 + 4.15.5 


7.6 Control of monitoring and measuring devices 


4.10 + 4.20.1 +4.20.2 


8 Measurement, analysis and improvement [title only] 




8.1 General 


4.11.1 +4.11.2 . 


8.2 Monitoring and measurement [title only} 

8.2.1 Feedback 

8.2.2 Internal audit 

8.2.3 Monitoring and measurement of processes 

8.2.4 Monitoring and measurement of product 


4.17 

4.17 + 4.20.1 +4.20.2 

4.10.2 + 4.10.3 + 4.10.4 + 4.10.5 + 4.20.1 + 4.20.2 


8.3 Control of nonconforming product 


4.13.1 +4.13.2 


8.4 Analysis of data 


4.20.1 +4.20.2 


8.5 Improvement [title only] 

8.5.1 General 

8.5.2 Corrective action 

8.5.3 Preventive action 


4.1.3 

4.14.1 +4.14.2 

4.14.1 +4.14.3 
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Annex B 

(informative) 

Explanation of differences between ISO 13485:2003 and ISO 9001 :2000 



This annex documents the similarities and differences between requirements clauses and subclauses 
and key informative clauses and subclauses of this International Standard and ISO 9001 . It also provides 
a rationale for the differences between this International Standard and ISO 9001 . 

a) For those clauses or subclauses of this International Standard that are quoted directly and unchanged 
from ISO 9001, the fact that these subclauses are presented unchanged is noted in this annex by a 
phrase appearing in square brackets [ ]. 

b) For those clauses or subclauses from ISO 9001 that are changed in this International Standard by the 
addition of information or by tailoring it to be consistent with medical device regulations, the entire 
original ISO 9001 text of the clause or subclause is reproduced in the left-hand column of this annex. 
The text of the corresponding clause or subclause in this International Standard is shown in the 
right-hand column. 

c) For those clauses or subclauses where this International Standard has deleted or amended the text of 
ISO 9001 by the deletion or significant modification of a substantive requirement, the entire original 
ISO 9001 text of the clause or subclause is reproduced in the left-hand column of this annex. The text 
of the corresponding clause or subclause in this International Standard and the reasons for the text 
changes are given in the right-hand column. 

d) The reasons for the differences between this International Standard and ISO 9001 are given in the 
right-hand column. Where no "reason for differences" is given for an individual clause or subclause, 
the text differences between the two International Standards arises from the objective of ISO 1 3485 to 
reflect the current regulations and facilitate the harmonization of new medical device regulations 
around the world. 



ISO 9001 :2000 


ISO 13485:2003 


Introduction 

0.1 General 

The adoption of a quality management system should 
be a strategic decision of an organization. The design 
and implementation of an organization's quality 
management system is influenced by varying needs, 
particular objectives, the products provided, the 
processes employed and the size and structure of the 
organization. It is not the intent of this International 
Standard to imply uniformity in the structure of quality 
management systems or uniformity of documentation. 

The quality management system requirements speci- 
fied in this International Standard are complementary 
to requirements for products. Information marked 
"NOTE" is for guidance in understanding or clarifying 
the associated requirement. 


Introduction 

0.1 General 

This International Standard, specifies requirements for a 
quality management system that can be used by an 
organization for the design and development, 
production installation and servicing of medical devices, 
and the design, development, and provision of related 
services. 

It can also be used by internal and external parties, 
including certification bodies, to assess the 
organization's ability to meet customer and regulatory 
requirements. 

It is emphasized that the quality management system 
requirements specified In this International Standard are 
complementary to technical requirements for products. 

Information marked "NOTE" is for guidance in 
understanding or clarifying the associated 
requirement. 
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[SO 9001 :2000 



ISO 13485:2003 



This International Standard can be used by internal 
and external parties, including certification bodies, to 
assess the organization's ability to meet customer, 
regulatory and the organization's own requirements. 

The quality management principles slated in 
ISO 9000 and ISO 9004 have been taken into 
consideration during the development of this 
Internationa! Standard. 



The adoption of a quality management system should 
hB a strategic decision of an organization. The design 
and implementation of an organization's quality 
management system is influenced by varying needs, 
particular objectives, the products provided, the 
processes employed and the size and structure of the 
organization. It is not the intent of this International 
Standard to imply uniformity in the structure of quality 
management systems or uniformity of documentation. 

There is a wide variety of medical devices and some 
of tfie particular requirements of this International 
Standard only apply to named groups of medical 
devices. These groups are denned in Clause 3. 

Reason for differences: Except for the contents of 
paragraph 4 of 0.1 of ISO 13485, any changes to the text 
of 0.1 of ISO 9001 is intended only to tailor this text for 
application to the medical device sector. 



0.2 Process approach 

This Intemational Standard promotes the adoption of 
a process approach when developing, implementing 
and improving the effectiveness of a quality 
management system, to enhance customer satis- 
faction by meeting customer requirements. 

For an organization to function effectively, it has to 
identify and manage numerous linked activities. An 
activity using resources, and managed in order to 
enable the transfonmation of inputs into outputs, can 
be considered as a process. Often the output from 
one process directly forms the input to the next. 

The application of a system of processes within an 
organization, together with the identification and 
interactions of these processes, and their 
management, can be referred to as the "process 
approach". 

An advantage of the process approach is the ongoing 
control that it provides over the linkage between the 
individual processes within the system of processes, 
as well as over their combination and interaction. 

When used within a quality management system, 
such an approach emphasizes the importance of 

a) understanding and meeting requirements, 

b) the need to consider processes in terms of 
added value, 

c) obtaining results of process performance and 
effectiveness, and 



0.2 Process approach 

This International Standard is based on a process 
approach to quality management. 

Any activity that receives inputs and converts them to 
outputs can be considered as a process. 

For an organization to function, effectively, it has to 
identify and manage numerous linked processes. 

Often the output from one process directly forms the 
input to the next. 

The application of a system of processes within an 
organization, together with the identification and inter- 
actions of these processes, and their management, 
can be referred to as the "process approach". 

Reason for differences: Much of the guidance containecr 
in 0.2 of ISO 9001 is being considered for inclusion in 
ISO/TR 14969, ttie Technical Report that is intended to 
provide guidance for the implementation of the 
requirements of ISO 13485. This information is included In 
this subclause of ISO 9001 because no such guidance 
document as ISO/TR 14969 exists. Because ISO/TR 14969 
Is being developed, the guidance text is not included in this 
subclause in ISO 1 3485. 
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d) continual improvement of processes based on 
objective measurement. 

The model of a process-based quality management 
system stiown in Figure ! illustrates the process 
linkages presented in Clauses 4 to 8. This illustration 
shows that customers play a significant role in 
defining requirements as inputs. Monitoring of 
customer satisfaction requires the evaluation of 
information relating to customer perception as to 
whether the organization has met the customer 
requirements. The model shown in Figure 1 covers all 
the requirements of this International Standard, but 
does not show processes at a detailed level. 

NOTE In addition, the methodology known as "Plan- 

Do-Check-Act" (PDCA) can be applied to all processes 
PDCA can be briefly described as follows. 



Plan: establish the objectives and processes to 
deliver results in accordance with customer 
requirements and the organization's 
policies. 

Do: implement the processes. 

Check: monitor and measure processes and 
product against policies, objectives and 
requirements for the product and report the 
results. 

Act: take actions to continually improve process 

perfomnance. 



ISO 13485:2003 



ContinusJ Improyemeni of 
Kie ctualF^y management system 




■ Vtfw-Kldna acNitaft 



Figure 1 — Model of a process-based quality 
management system 
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0.3 Relationshijs writh ISO 9004 

The present editions of ISO 9001 and ISO 9004 tiave 
been developed as a consistent pair of quality 
management system standards v^ich have been 
designed to complement each other, but can also be 
used independently. Although the two International 
Standards have different scopes, they have similar 
structures in order to assist their application as a 
consistent pair. 

ISO 9001 specifies requrrements for a quality 
management system that can be used for intemal 
application by organizations, or for certification, or for 
contractual purposes. It focuses on the effecttv^ess 
of the quality management system in meeting 
customer requirements. 

ISO 9004 gives guidance on a wider range of 
objectives of a quality management system than does 
ISO 9001 , particularly for the continual improvement 
of an organization's overall perfonnance and 
efficiency, as well as its effectiveness. ISO 9004 is 
recommended as a guide for organizations whose top 
management wishes to move beyond the 
requirements of ISO 9001 , in pursuit of continual 
improvement of perfomiance. Howeyer, it is not 
intended for certification or for contractual purposes. 


0.3 Relationship mOi otfter sthndar^ 

0.3.1 Relationsit^ vnth ISO 9001:20W 

While this is a stand-alone standard, it is based on 
ISO 9001. 

Those clauses or subclauses that are quoted direcOy 
and unchanged from ISO 9001 are in nonnal fonf. 
The fact that ttiese subclauses are presented 
unchanged is noted in Annex B. 

Where the text of this International Standard is not 
identical to tfie text of ISO 9001, the sentence or 
indent containing that text as a whc^ is shown in 
italics (and blue italics fyr electronic versions). The 
nature and reasons for the text changes are noted in 
Annex B. 

0.3.2 Relationship with iSO/TR 14969 

ISO/TR 14969 is a Technical Report intended to 
provide guidance for the application of ISO 13485. 

Reason for differences: There is no significant 
relationship between ISO 13485 and ISO 9004. The key 
relationshipfr- that benefit from explanation in fills 
lntrodu<^ry subclause are the ones between )S013485 
and ISO 9001 andtSOnK 14969. 


0.4 Compatibility with otiier management 
systems 

This International Standard has been aligned with 
ISO 14001 :1996 in order to enhance the compatibility 
of the two standards for the benefit of the user 
community. 

This International Standard does not indude 
requirements specific to other management systems, 
such as those particular to environmental manage- 
ment, occupational health and safety management, 
financial management or risit management. However, 
this International Standard enables an organization to 
align or integrate its own quality management system 
with related management system requirements. It is 
possible for an organization to adapt its existing 
management system(s) in order to establish a quality 
management system that complies with the 
requirements of this International Standard. 


0.4 Compatibility with other management 
syst^ns 

This IntemaOonal Standard fr^lows ffie format of 
ISO 9001 for the convenience of users in the medical 
device community. 

This International Startdard does not include 
requirements specie to other management systems, 
such as those particular to environmental manage- 
ment, dccupaVonal health and safety management, 
or financial management. 

However, this International Standard enables an 
organization to align or integrate its own quality 
management system witti related management 
system requirements. It is possible for an 
organization to adapt its existing management 
system(s) in order to establish a quality management 
system that complies with the requirements of this 
International Standard. 

RMSon for differences: The first paragraph of 0.4 of 
IS0 13485 emptiasizes the alignment of ISO 13485 with 
ISO 9001 . 
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Risk management is a key requirement in many activities 
and requirements associated with quality management 
systems for medical device organizations. 



1 Scope 

1,1 General 

This tntemationat Standard ^sectfles requirentents for 
a quality management system where an organization 

a) needs to demonsfrate its abiiity to consistently 
provide product that meets customer and applic- 
able regulatory requirements, and 

b) aims to enhance customer satisfaction through 
the effective application of the system, including 
processes for continual improvement of the 
system and the assurance of confomiity to 
oistomer and applicable regulatory require- 
ments. 

NOTE In this IntemaSonal Standard, the temi 
'producf applies only to ^e product intended for, or 
required by. a customer. 



1 Scope 

1.1 General 

Wis Intematjonal Standard spectres raquirements for 
a quaBty managemera system where an organization 
needs to demonstrate its ability to provide medical 
devKes and related services tttat con^tently meet 
customer requirements and regulatory requirements 
applicable to medical devices and related services. 

The primary objective of this International Standard is 
to facilitate harmonized medical device regulatory 
requirements for quality management systems. As a 
result, it includes sonw particular requirements for 
medical cfewces and excludes some of the 
requirements of ISO 9001 that are not appropriate as 
regulatory requirements. Because of these 
exclusions, organizations whose quality management 
systems conform to this International Standard 
cannot claim conforriHty to ISO 9001 unless their 
quality management systems conform to all the 
requirements of ISO 9001 (see Annex B). 

Reason for differences: This subclause uses and explains 
tenms that ate appropriate for the medical device sector. In 
addition, the temns "customer satisfeidion" and "continual 
improvemenf are eliminated as they are not relevant in a 
standard whose objecti\« is to facilitate the hamiontzation 
of medical device i«gulatk>r» tor quality management 
systems around the worid, 

Paragraph 2 is Intended to clarify that the intent of 
ISO 13485 is to facilitate the harmonization of regulatory 
quality management system requirements around the 
world, to point out that this intent requires the addition of 
some requirements not found in ISO 9001 and the deletion 
of some requirements that are found In ISO 9001, and to 
darify the fact that adherence to ISO 13485 cannot result in 
Qie daim of adherence to ISO 9001 . 

The term "and related services' has tieen added twice to 
modify the term "medical devices' because "medical 
device" does not include "services" in its definition. This is 
in confrast to iSO90O1. where the temi "producT does 
include "services" as part of its definition. 
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112 Application 

All requirements of this International Standard are 
generic and are intended to be applicable to all 
organizations, regardless of type, size and product 
provided. 

Where any requirement(s) of this International 
Standard cannot be applied due to the nature of an 
organization and its product, this can be considered 
for exclusion. 

Where exclusions are made, claims of confomriity to 
this Intemational Standard are not acceptable unless 
these exclusions are limited to requirements within 
Clause?, and such exclusions do not affect the 
organization's ability, or responsibility, to provide 
product that meets customer and applicable 
regulatory requirements. 



1.2 Appfication 

All requirements of this Intemational Standard am 
specific to organiza^ns pnjviding medical devices, 
regardless oftite type or^e of the orgaruzation. 

If regulatory requirements permit exclusions of design 
and development controls (see 7.3), this can be used 
as a justification for their exclusion from the quality 
management system. These regulations can provide 
alternative arrangements that must be addressed in 
the quality management system. It is the respon- 
sibility of the organization to ensure that daims of 
conformity with this International Standard reflect 
exclusion of design and development controls [see 
4.2.2 a) and 7.3}. 

If any requirement(s) in Clause 7 of this Intemational 
Standard is not applicable due to the nature of the 
medical device(s) for which the quality management 
system is applied, the organization does not need to 
include such a requirement(s) in its quality 
\ mana^mertt system [see 4.2.2 a)]. 

The processes required by &iis fntema^onal 
Standard, which are applicaNe to the medical 
device(s), but which are not performed by the 
organization, are the responsibility of the organization 
and are accounted for in the organization's quality 
management system [see 4. 1 a)]. 

In this Intemational Standard f/ie terms 'if 
appropriate" and "^vhere appropriate' are used 
seveml Vnfws. When a requirement is qualified by 
either of ttwse phra^s, it is deemed to fte 
'appropriate" unless the organization can document a 
ju^cation otherwise. A requirement is considered 
'appropriate" if it is necessary in order for 

a) the product to meet specified requirements, 
andfyr 

b) the organiza&on to carry out corrective action. 

R«a$on for cNfferences: The text darifles the fact that the 
requirements of tS0 13485 are specific to the medical 
de\flce sector. In addition, it amplifies the relationship 
t>etyveen exclusions for design and development that might 
have regulatory Impact in certain locations in the world. 
Finally, it distinguishes between the requirements In 
Clause? which an organization may with regulatory 
justification exclude from its quality management system 
(limited to 7.3), even though they may perfbmi activites to 
which those requirements relate, and those which the 
organization may with justification not include Its quality 
management system t)ecause they relate to activities not 
perfomned t>y the organization. 
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2 Normative reference 

Hie following normative document contains 
pFo\^sions which, through reference in this text, 
constitute provisions of this Intemational Standard. 
For dated references, subsequent amendments to, or 
revisions of, any of these pubticalions do not apply. 
However, partie^ to agreement based on this 
Jnt^natibnal Standard are encouraged to nwestigate 
the possibility of applying the nnost recent edition of 
the normative document indicated betow. For 
undated references, the latest edition of tfie 
normative document referred to applies. Members of 
ISO and lEC maintain registers of currently valid 
Intemational Standards. 

ISO 9000:2000. Quality management systems — 
Fundamentals and vocabulary 



2 Normative references 

The folloiMng referenced documents are indis 
pensalile for tfie application of this document For 
dated references, only the edition cited applies. For 
undated references, the latest edition of the 
referenced document (including any amendments) 
applies. 

180 9000:2000, QuaUty management systems- 
Fundamentals and vocabulary 

Reason for dtffinences: The ISO 13485 text reflects 
a revision required by the 2001 edition of the iSO/lEC 
Directives, Part 2, 



3 Terms and definitions 

For the purposes of this International Standard, \he 
terms and definitions given in ISO 9000 apply. 

Hie following tenns, used in this edition of ISO 9001 
to describe the supply chain, have been changed to 
reflect the vocabulary currently used; 

supplier — > organization — > customer 

The term 'organization" replaces the term "supplier" 
used in 180 9001:1994, and refers to the unit to 
which this Intemational Standard applies. Also, the 
term "supplier" now replaces the term "sub- 
contractor^. 

Throughout the text of this International Standard, 
wherever the term "product" occurs, it can also mean 
service". 



3 Terms and definitions 

For the purposes of this document, the tenms and 
definitions given in ISO 9000 apply, together with the 
following. 

The following terms, used in this edition of ISO 13485 
to describe the supply chain, have been changed to 
reflect the vocabulary currently used: 

supplier — > organization — > customer 

The term "organization' replaces the term 'supplier" 
used in ISO 13485:1996. ^a&^ refers to the unit to 
which this Intemational Standard applies. Also, the 
tenrt "supplier" now replaces the term 'suti- 
contractor". 

Throughout the text of this International Standard, 
wherever the term "produ(pf occur*,- it can also mean 
service". 

Wherever requirements are specified as applying to 
"medical devices", the requirements apply equally to 
related services as supplied by the organization. 

The following defmitions should be regarded as 
generic, as definitions provided in national regulations 
can differ slightly and take precedence. 

Reason for differences: The text is tailored for use in the 
medical device sector and also includes a caveat related to 
the-fact that lex:al regulations might have a deflmtion that 
supercedes that contained or referenced in ISO 13485. 
Definitions 3.1 to 3.8 are specific to the medical device 
sector. 
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4 Quality management system 

4.1 General requirements 

The organization shall establish, document, imple- 
ment and maintain a quality management system and 
continually improve its effectiveness in accordance 
with the requirements of this International Standard. 

The organization shall 

a) identify the processes needed for the quality 
management system and their application 
throughout the organization (see 1.2), 

b) determine the sequence and interaction of these 
processes, 

c) determine criteria and methods needed to 
ensure that both the operation and control of 
these processes are effective, 

d) ensure the availability of resources and inform 
ation necessary to support the operation and 
monitoring of these processes, 

e) monitor, measure and analyze these processes, 
and 



f) implement actions necessary to achieve planned 
results and continual improvement of these 
processes. 

These processes shall be managed by the 
organization in accordance with the requirements of 
this International Standard. 

\Miere an organization chooses to outsource any 
process that affects product conformity with 
requirements, the organization shall ensure control 
over such processes. Control of sucti outsourced 
processes shall be identified within the quality 
management system. 

NOTE Processes needed for ttie quality management 
system referred to above should include processes for 
management activities, provision of resources, product 
realization and measurement. 



4 Quality management system 

4.1 General requirements 

The organization shall establish, document, in^tle- 
ment and maintain a quality management system and 
maintain its effectiveness in accordance with ttm 
requirements of this international Standard. 

The organization shall 

a) identify tiie processes needed for the quality 
management system and tiieir application 
throughout the organization <see 1 .2), 

b) determine the sequence and interaction of these 
processes, 

c) determine criteria and methods needed to 
ensure that both the operation and control of 
these processes are effective, 

d) ensure the availability of resources and inform- 
ation necessary to support the operation and 
monitoring of these processes, 

e) monitor, measure and analyse these processes, 
and 



f) implement actions necessary to achieve planned 
results and maintain the effectiveness of these 
processes. 

These processes shall be managed by the 
organization in accordance with the requirements of 
this Intemational Standard. 

Where an organization chooses to outsource any 
process that affects product conformity with 
requirements, the organization shall ensure control 
over such processes. Control of such outsourced 
processes shall be identified within the quality 
management system (see 8.5.1). 

NOTE Processes needed for the quality management 
system referred to above should include processes for 
management activities, provision of resources, product 
realization and measurement. 

Reason for differences: The resulting text is consistent 
with ttie objectives of reflecting the current regulations and 
facilitating ttie tiamionization of new medical de\rice 
regulations around the workl. Cun^nt regulations are 
targeted at the effectiveness of the quality management 
system to consistently produce safe and effective products. 
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4.2 Documentation requirements 
4.2.1 General 

The quality management system documentation siiall 
inciude 

a) documented statements of a quality policy and 
quality objectives, 

b) a quality manual, 

c) documented procedures required by tfiis Inter- 
national Standard, 

d) documents needed by frie organization to ensure 
ttie effective planning, operation and control of its 
processes, and 

e) records required by this International Standard 
(see 4.2.4). 

NOTE 1 Where the term "doaimented procedura" 
appears within Hiis Internationa! Standard, this means tliat 
»ie procedure is established, documented, implemented 
and maintained. 

NOTE 2 The extent of the quality management s^tem 
docum&itation can differ from one organization to another 
dueto 

a) the size of the otganizatian and type of activities, 

b) tie complexity of processes and their nteradions. and 

c) the competerice of personnel. 

NOTE 3 The doojmentation can be in any form or type 
of medium. 



4.2 Documentation requirements 
4.2.1 General 

The quality management system documentation 
shall include 

a) documented statements of a quality policy and-' 
quality objectives, 

b) a quality manual, 

c) documented procedures required by this Inter- 
national Standard, 

d) documents needed by the organization to ensure 
the effective planning, operation and control of its 
processes, 

e) records required by this Internationa! Standard 
(see A.2.4), and 

f) any other documentation specified by nationa! or 
regional regulations. 

Where this International Standard specifies that a 
requirement, procedure, activity or special arrange 
ment be "documented", it shall, in addition, be 
implemented and maintained. 

For each type or model of medical device, the 
organization shall estat}lish and maintain a file either 
containing or identifying documents denning product 
speccSe^ftons and quality management system 
mqmements (see 4.2.3). These documents shall 
define the comf^te manufatOuring process and, if 
apf^ic^e, kistatlaSon and servicing. 

NOTE 1 The extent of the quality management system 
documentation can differ from one organization to another 
due to 

a) the size of the organization and type of activities, 

b) the complexity of processes and their interactions, and 

c) the competence of personnel. 

NOTE 2 The documentafion can be in any fomi or type 
of nnedium. 

Reason for differences: The text irj 4.2,1 of ISO 134d5 
includes all of the requirements contained in flie 
corresponding suljclause of ISO 9001 , wiSi the addition of 
a general statement related to regulafions that might 
contain documentation requirements and a specific 
requtnement for a file containing specified documents for 
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each type/model of medical device. In addition, the text 
includes the documentation requirements for activities and 
special arrangements. The resulting text is consistent with the 
objectives of reflecting the current regulations and 
facilitating the harmonization of new medical device 
regulations around the world. 


4.2.2 Quality manual 

The organization shall establish and maintain a quality 
manual that includes 

a) the scope of the quality management system, 
including details of and justification for any 
exclusion (see 1 .2), 

b) the documented procedures established for the 
quality management system, or reference to 
them, and 

c) a description of the interaction between the 
processes of the quality management system. 


4.2.2 Quality manual 

The organization shall establish and maintain a quality 
manual that includes 

a) the scope of the quality management system, 
including details of and justification for any 
exclusion and/or non-application (see 1,2), 

b) the documented procedures established for the 
quality management system, or reference to 
them, and 

c) a description of the interaction between the 
processes of the quality management system. 

The quality manual shall outline the structure of the 
documentation used in the quality management system. 


4.2.3 Control of documents 

Documents required by the quality management system 
shall be controlled. Records are a special type of 
document and shall be controlled according to the 
requirements given in 4.2.4. 

A documented procedure shall be established to define 
the controls needed 

a) to approve documents for adequacy prior to 
issue. 

b) to review and update as necessary and re- 
approve documents, 

c) to ensure that changes and the current revision 
status of documents are identified, 

d) to ensure that relevant versions of applicable 
documents are available at points of use, 

e) to ensure that documents remain legible and 
readily identifiable, 

f) to ensure that documents of external origin are 
identified and their distribution controlled, and 

g) to prevent the unintended use of obsolete 
documents, and to apply suitable identification to 
them if they are retained for any purpose. 


4.2.3 Control of documents 

Documents required by the quality management system 
shall be controlled. Records are a special type of document 
and shall be controlled according to the requirements given 
in 4.2.4. 

A documented procedure shall be established to define the 
controls needed 

a) to review and approve documents for adequacy 
prior to issue, 

b) to review and update as necessary and re- 
approve documents, 

c) to ensure that changes and the current revision 
status of documents are identified, 

d) to ensure that relevant versions of applicable 
documents are available at points of use, 

e) to ensure that documents remain legible and 
readily identifiable, 

f) to ensure that documents of external origin are 
identified and their distribution controlled, and 

g) to prevent the unintended use of obsolete 
documents, and to apply suitable identification to 
them if they are retained for any purpose. 
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The organization shall ensure that changes to 
documents are reviewed and approved either by the 
original approving function or another designated 
function which has access to pertinent background 
information upon which to base its decisions. 

The organization shall define the period for which at least 
one copy of obsolete controlled documents shall be 
retained. This period shall ensure that documents to 
which medical devices have been manufactured and 
tested are available for at least the lifetime of the 
medical device as defined by the organization, but not 
less than the retention period of any resulting record 
(see 4.2.4), or as specified by relevant regulatory 
requirements. 


4.2.4 Control of records 

Records shall be established and maintained to provide 
evidence of conformity to requirements and of the 
effective operation of the quality management system. 
Records shall remain legible, readily identifiable and 
retrievable, A documented procedure shall be 
established to define the controls needed for the 
identification, storage, protection, retrieval, retention 
time and disposition of records. 


4.2.4 Control of records 

Records shall be established and maintained to provide 
evidence of conformity to requirements and of the 
effective operation of the quality management system. 
Records shall remain legible, readily identifiable and 
retrievable. A documented procedure shall be 
established to define the controls needed for the 
identification, storage, protection, retrieval, retention 
time and disposition of records. 

The organization shall retain the records for a period of 
time at least equivalent to the lifetime of the medical 
device as defined by the organization, but not less than 
two years from the date of product release by the 
organization or as specified by relevant regulatory 
requirements. 


5 Management responsibility 

5.1 lUlanagement commitment 

Top management shall provide evidence of its 
commitment to the development and implementation of 
the quality management system and continually 
improving its effectiveness by 

a) communicating to the organization the impor- 
tance of meeting customer as well as statutory 
and regulatory requirements, 

b) establishing the quality policy, 

c) ensuring that quality objectives are established, 

d) conducting management reviews, and 

e) ensuring the availability of resources. 


5 lUlanagement responsibility 

5.1 Management commitment 

Top management shall provide evidence of its 
commitment to the development and implementation of 
the quality management system and maintaining its 
effectiveness by 

a) communicating to the organization the impor- 
tance of meeting customer as well as statutory 
and regulatory requirements, 

b) establishing the quality policy, 

c) ensuring that quality objectives are established, 

d) conducting management reviews, and 

e) ensuring the availability of resources. 
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5.2 Customer focus 

Top management shall ensure that customer 
requirements are determined and are met with the 
aim of enhancing customer saUsfaction (see 7.2.1 
and 8.2.1). 



ISO 13485:2(M)3 



NOTE For the purfx^es of mis Intemathnal Standard, 
statutory mquirarrten^ are limited to the safety arid 
perfamarxx cfthe metXcal device only. 

Reason for dtiferences: TWs text is consistent with the 
objective of reflecting the current regulation and facilitating 
the harmonizetion of new medical device regulattons 
around the world. Current regulafons are targeted at the 
effectiveness of the quality management system to 
consistenUy produce safe and effective products. 



5.3 Quality policy 

Top management shall ensure that the quality policy 

a) is appropriate to the purpose of the organization, 

b) includes a commitment to comply with require- 
ments and continually improve the effectiveness 
of the quality management system, 

c) provides a framew/orlt for establishing and 
reviewing quality objectives, 

d) is communicated and understood within the 
organization, and 

e) is reviewed for continuing suitability. 



5.2 Customer focus 

Top management sfiall ensure ttiat customer 
requirements are determined and are met (see 7.2.1 
and 8.2.1). 



Reason, for differences: The rewording of the text is 
consistent with the position that customer satisfaction is not 
an appropriate regulatory objective of medica! devices. As a 
result, this text Is consistent with the objective of ISO 13485 
to facilitate the harmonization of quality management 
system regulations around the world. 



5.3 Quality policy 

Top management shall ensure that the quality policy 

a) is appropriate to the purpose of the organization, 

b) includes a commitnwnt to comply with require- 
ments and to maintain the effectiveness of the 
quality management system, 

c) provides a framework for establishing and 
reviewing quality objectives, 

d) is communicated and understood within the 
organization, and 

e) is reviewed for continuing suitability. 

Reason for differences: The text of 5.3 of ISO 134B5 
eliminates from item b) the commitment to continually 
improve the effectiveness of the quality management 
system and substitutes the commitment to maintain the 
effectiveness of the quality management system. TTiis 
substitution is consistent with the objective of current 
regulations and is intended to facilitate the hamonization of 
quality management system regulaf ons around the world. 



5.4 Planning 

[The text of 5.4 in ISO 13485 is identical to that in the 
corresponding subclause of ISO 9001.] 
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5.5 Responsibility, autliority and 
communication 

5.5.1 Responsibility and authority 

Top management shall ensure that responsibilities 
and authorities are defined, documented and 
communicated within the organization. 


5.5 Responsibility, authority and 
communication 

5.5.1 Responsibility and authority 

Top management shall ensure that responsibilities 
and authorities are defined, documented and 
communicated within the organization. 

Top management shall establish the interrelation of 
all personnel who manage, perform and verify work 
affecting quality, and stall ensure the independence 
and authority necessary to perform these tasks. 

NOTE Nfitinnal or regbnal regulation might lequire the 
nomination of specitic persons as lesponsbb for activities related 
to monitoring experience from tiie post-production stxie and 
iepoitingad\^rse events (see 82.1 and 85.1). 


5.5.2 Management representative 

Top management shall appoint a member of 
management who, irrespective of other respon- 
sibilities, shall have responsibility and authority that 
includes: 

a) ensuring that processes needed for the quality 
management system are established, imple- 
mented and maintained; 

b) reporting to top management on the performance 
of the quality management system and any need 
for improvement; and 

c) ensuring the promotion of awareness of 
customer requirements throughout the organ- 
ization. 

NOTE The responsibility of a management 
representative can include liaison with external 
parties on matters relating to the quality 
management system. 


5.5.2 Management representative 

Top management shall appoint a member of 
management who, irrespective of other respon- 
sibilities, shall have responsibility and authority that 
includes 

a) ensuring that processes needed for the quality 
management system are established, imple 

mented and maintained; 

b) reporting to top management on the performance 
of the quality management system and any need 
for improvement (see 8.5); and 

c) ensuring the promotion' of awareness of 
regulatory and customer requirements through 
out the organization. 

NOTE The responsibility of a management 
representative can include liaison with external 
parties on matters relating to the quality 
management system. 




5.5.3 Internal communication 

[The text of 5.5.3 in ISO 1 3485 is identical to that in 
the corresponding subclause of ISO 9001 .] 


5.6 Management review 


5.6 Management review 

5.6.1 General 

[The text of 5.6.1 in ISO 13485 is identical to that in 
the corresponding subclause of ISO 9001 .] 



37 



IS/ISO 13485: 2003 



ISO 9001 :2000 


ISO 13485:2003 


5.6.2 Review input 


5.6.2 Review input 


The input to management review shall include information 
on 


The input to management review shall include 
information on 


a) results of audits, 


a) results of audits. 


b) customer feedback, 

c) process performance and product conformity, 

d) status of preventive and corrective actions, 

e) follow-up actions from previous management 
reviews, 

f) changes that could affect the quality man 
agement system, and 


b) customer feedback, 

c) process performance and product conformity, 

d) status of preventive and corrective actions, 

e) follow-up actions from previous management 
reviews, 

f) changes that could affect the quality man 
agement system, 

g) recommendations for improvement, and 


g) recommendations for improvement. 


h) new or revised regulatory requirements 


5.6.3 Review output 


5.6.3 Review output 


The output from the management review shall include any 
decisions and actions related to 


The output from the management review shall include 
any decisions and actions related to 


a) improvement of the effectiveness of the quality 
management system and its processes 

b) improvement of product related to customer 
requirements, and 


3j improvements needed to maintain the effec- 
tiveness of the quality management system and 
its processes, 

b) improvement of product related to customer 
requirements, and 


c) resource needs. 


c) resource needs. 


6 Resource management 


6 Resource management 


6.1 Provision of resources 


6.1 Provision of resources 


The organization shall determine and provide the resources 
needed 


The organization shall determine and provide the 
resources needed 


a) to implement and maintain the quality 
management system and continually improve its 
effectiveness, and 

b) to enhance customer satisfaction by meeting 
customer requirements. 


a) to implement the quality management system 
and to maintain its effectiveness, and 

b) to meet regulatory and customer requirements. 


6.2 Human resources 


6.2 Human resources 




6.2.1 General 




[The text of 6.2.1 in ISO 13485 is identical to that in 
the corresponding subclause of ISO 9001.] 
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6.2.2 Competence, awareness and training 

The organization shall 

a) determine the necessary competence for 
personnel performing work affecting product 
quality, 

b) provide training or take other actions to satisfy 
these needs, 

c) evaluate the effectiveness of the actions taken, 

d) ensure that its personnel are aware of the 
relevance and importance of their activities and 
how they contribute to the achievement of the 
quality objectives, and 

e) maintain appropriate records of education, 
training, skills and experience, training, skills and 
experience {see 4.2.4). 


6.2.2 Competence, awareness and training 

The organization shall 

a) determine the necessary competence for 
personnel performing work affecting product 
quality, 

b) provide training or take other actions to satisfy 
these needs, 

c) evaluate the effectiveness of the actions taken, 

d) ensure that its personnel are aware of the 
relevance and importance of their activities and 
how they contribute to the achievement of the 
quality objectives, and 

e) maintain appropriate records of education, 
training, skills and experience (see 4.2.4). 

NO TE National or regional regulations might require 
the organization to establish documented procedures 
for Identifying training needs. 


6.3 Infrastructure 

The organization shall determine, provide and 
maintain the infrastructure needed to achieve 
conformity to product requirements. Infrastructure 
includes, as applicable 

a) buildings, workspace and associated utilities, 

b) process equipment (both hardware and soft 
ware), and 

c) supporting services (such as transport or 
communication). 


6.3 Infrastructure 

The organization shall determine, provide and 
maintain the infrastructure needed to achieve 
conformity to product requirements, infrastructure 
includes, as applicable 

a) buildings, workspace and associated utilities, 

b) process equipment (both hardware and soft 
ware), and 

c) supporting services (such as transport, or 
communication). 

The organization shall establish documented 
requirements for maintenance activities, Including their 
frequency, when such activities or lack thereof can affect 
product quality. 

Records of such maintenance shall be maintained (see 
4.2.4). 


6.4 Work environment 

The organization shall determine and manage the 
work environment needed to achieve conformity to 
product requirements. 


6.4 Work environment 

The organization shall determine and manage the 
work environment needed to achieve conformity to 
product requirements. The following requirements 
shall apply. 

a) The organization shall establish documented 
requirements for health, cleanliness and clothing of 
personnel If contact between such personnel 
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and the product or work environment could 
adversely affect the quality of the product (see 
7.5.1.2.1). 

b) If work environment conditions can have an 
adverse effect on product quality, the organization 
shall establish documented requirements for the 
work environment conditions and documented 
procedures or work instructions to monitor and 
control these work environment conditions (see 
7.5.1.2.1). 

c) The organization shall ensure that all personnel 
who are required to work temporarily under 
special environmental conditions within the won\ 
environment are appropriately trained or 
supervised by a trained person [see 6.2.2 b)J. 

1) If appropriate, special arrangements shall be 
established and documented for the control of 
contaminated or potentially contaminated 
product in order to prevent contamination of 
other product, the work environment or 
personnel (see 7.5.3. 1). 


7 Product realization 

7.1 Planning of product realization 

The organization shall plan and develop the 
processes needed for product realization. Planning of 
product realization shall be consistent with the 
requirements of the other processes of the quality 
management system (see 4.1). 

In planning product realization, the organization shall 
determine the following, as appropriate: 

a) quality objectives and requirements for the 
product; 

b) the need to establish processes, documents, and 
provide resources specific to the product; 

c) required verification, validation, monitoring, in 
spection and test activities specific to the product 
and the criteria, for product acceptance; 

d) records needed to provide evidence that the 
realization processes and resulting product meet 
requirements (see 4.2.4). 

The output of this planning shall be in a form suitable 
for the organization's method of operations. 


7 Product realization 

7.1 Planning of product realization 

The organization shall plan and develop the 
processes needed for product realization. Planning of 
product realization shall be consistent with the 
requirements of the other processes of the quality 
management system (see 4.1). 

In planning product realization, the organization shall 
determine the following, as appropriate: 

a) quality objectives and requirements for the 
product; 

b) the need to establish processes, documents, and 
provide resources specific to the product; 

c) required verification, validation, monitoring, in 
spection and test activities specific to the product 
and the criteria for product acceptance; 

d) records needed to provide evidence that the 
realization processes and resulting product meet 
requirements (see 4.2.4). 

The output of this planning shall be in a form suitable 
for the organization's method of operations. 
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NOTE 1 A document specifying the processes of tfie quality 
management system (including the product realization 
processes) and the resources to be applied to a specific 
product, project or contract, can be referred to as a quality 
plan. 

NOTE 2 The organization may also apply the 
requirements given in 7.3 to the development of product 
realization processes. 


The organization shall establish documented 
requirements for risk management throughout 
product realization. Records arising from risk 
management shall be maintained (see 4.2.). 

NOTE 1 A document specifying the processes of the quality 
management system (including the product realization 
processes) and the resources to be applied to a specific 
product, project or contract can be referred to as a quality plan. 

NOTE 2 The organization may also apply the 
requirements given in 7.3 to the development of product 
realization processes. 

NOTE 3 See ISO 14971 for guidance related to risk 
management. 

Reason for differences: To make the resulting text 
consistent with the objective of reflecting the current 
regulations and facilitating the harmonization of new 
medical device regulations around the world. Risk 
management is a key activity that determines the nature 
and amount of activity in many of the areas addressed 
by the medical device organization's quality 
management system. 


7.2 Customer-related processes 


7.2 Customer-related processes 

7.2.1 Determination of requirements related to the 
product 

[TheXexX of 7.2.1 in ISO 13485 is identical to that in the 
corresponding subclause of ISO 9001 .} 


7.2.2 Review of requirements related to the 
product 

The organization shall review the requirements 
related to the product. This review shall be conducted 
prior to the organization's commitment to supply a 
product to the customer (e.g. submission of tenders, 
acceptance of contracts or orders, acceptance of 
changes to contracts or orders) and shall ensure that 

a) product requirements are defined, 

b) contract or order requirements differing from 
those previously expressed are resolved, and 

c) the organization has the ability to meet the 
defined requirements. 

Records of the results of the review and actions arising 
from the review shall be maintained (see 4.2.4). 


7.2.2 Review of requirements related to the 
product 

The organization shall review the requirements 
related to the product. This review shall be conducted 
prior to the organization's commitment to supply a 
product to the customer (e.g. submission of tenders, 
acceptance of contracts or orders, acceptance of 
changes to contracts or orders) and shall ensure that 

a) product requirements are defined and docu 
mented, 

b) contract or order requirements differing from 
those previously expressed are resolved, and 

c) the organization has the ability to meet the 
defined requirements. 

Records of the results of the review and actions arising 
from the review shall be maintained (see 4.2.4). 
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Where the customer provides no documented 
statement of requirement, the customer requirements 
shall be confirmed by the organization before 
acceptance. 

Where product requirements are changed, the 
organization shall ensure that relevant documents are 
amended and that relevant personnel are made aware 
of the changed requirements. 

NOTE In some situations, such as internet sales, a formal 
review is impractical for each order. Instead the review can 
cover relevant product information such as catalogues or 
advertising material. 


Where the customer provides no documented 
statement of requirement, the customer requirements 
shall be confirmed by the organization before 
acceptance. 

Where product requirements are changed, the 
organization shall ensure that relevant documents are 
amended and that relevant personnel are made 
aware of the changed requirements. 

NOTE in some situations, such as internet sates, a formal 
review is impractical for each order. Instead the review can 
cover relevant product information such as catalogues or 
advertising material. 


7.2.3 Customer communication 

The organization shall determine and implement 
effective arrangements for communicating with cus- 
tomers in relation to 

a) product information, 

b) enquiries, contracts or order handling, including 
amendments, 

c) customer feedback, including customer com 
plaints. 


7.2.3 Customer communication 

The organization shall determine and implement 
effective arrangements for communicating with cus- 
tomers in relation to 

a) product information, 

b) enquiries, contracts or order handling, including 
amendments, 

c) customer feedback, including customer com 
plaints (see 8.2. 1), and 

d) advisory notices (see 8.5. 1). 


7.3 Design and development 

7.3.1 Design and development planning 

The organization shall plan and control the design and 
development of product. 

During the design and development planning, the 
organization shall determine 

a) the design and development stages, 

b) the review, verification and validation that are 
appropriate to each design and development 

stage, and 

c) the responsibilities and authorities for design and 
development. 

The organization shall manage the interfaces 
between different groups involved in design and 
development to ensure effective communication and 
clear assignment of responsibility. 

Planning .output shall be updated as appropriate, as the 
design and development progresses (see 4.2.3). 


7.3 Design and development 

7.3.1 Design and development planning 

Ttie organization shall establish documented pro- 
cedures for design and development. 

The organization shall plan and control the design and 
development of product. 

During the design and development planning, the 
organization shall determine 

a) the design and development stages, 

b) the review, verification, validation and design 
transfer activities (see Note) that are appropriate 
at each design and development stage, and 

c) the responsibilities and authorities for design and 
development. 

The organization shall manage the interfaces 
between different groups involved in design and 
development to ensure effective communication and 
clear assignment of responsibility. 
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Planning output sfiafi be documented, and updated 
as appropriate, as the design and development 
progresses (see 4.2.3). 

NOTE Design transfer activities during the design and 
development process ensure ttiat design and development 
outputs are verified as swtat)le for manufacturing before 
becoming final production specifications. 

Reason for differences: TInis text is consistent with the 
objective of reflecting the current regulations and facilitating 
the hamiontzation of new medical device regulations 
around flie world. In general, IS0 13485 retains the same 
level of documented procedure requirements contained in 
130 9001:1994, the standard with which many local 
regulations are consistent. 


7.3.2 Draign and development inputs 

Inputs relating to product requirements shall be 
detemnined and records maintained (see 4.2.4). 
These inputs shall include 

a) functional and perfonnance requirements, 

b) applicable statutory and regulatory requireinents, 

c) where applicable, information derived from 
previous similar designs, and 

d) other requirements essential for design and 
development. 

These inputs shall be reviewed for adequacy. 
Requiremertts shall be complete, unambiguous and 
not in conflict with each other. 


7.3.2 Design and development inputs 

Inputs relating to product requirements shall be 
determined and records maintained (see 4.2.4). 
These inputs shall include 

a) functional, performance and safety requirements, 
according to tfie intended use, 

b) applicable statutory and regulatory requirements. 

c) where applicable, information derived from 
previous similar designs, 

d) other requirements essential for design and 
development, and 

e) output(s) of risk management (see 7. 1). 

These inputs shall ft© revievtred for adequacy and 
approved. 

Requirements shall be complete, unambiguous and 
not in conflict with each other. 


7.3.3 Design and development outputs 

The outputs of design and development shall be 
provided in a form that enables verification against 
the design and development input and shall be 
approved prior to release. 

Design and development outputs shall 

a) meet the input requirements for design and 
development, 

b) provide appropriate information for purchasing, 
production and for service provision. 


7.3.3 Design and development outputs 

The outputs of design and development shall be 
provided in a form that enables verification against 
the design and development input and shall be 
approved prior to release. 

Design and development outputs shall 

a) meet the input requirements for design and 
development, 

b) provide appropriate information for purchasing, 
production and for service provision. 
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c) cxjntain or reference product acceptance criteria, 
and 

d) specify the characteristics of the product that are 
essential for its safe and proper use. 



7.3.4 Design and development review 

At suitable stages, systematic reviews of design and 
development shall be performed in accordance with 
planned arrangements (see 7.3.1) 



a) 



b) 



to evaluate the ability of the results of design and 
development to meet requirements, and 



to identify any problems and propose necessary b) 
actions. 
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c) contain or reference product acceptance criteria, 
and 

d) specify the characteristics of the product that are 
essential for its safe and proper use. 

Records of the design and development outputs shall 
be maintained (see 4.2.4). 

NOTE Records of design and development outputs 
can include speci^cations, manufacturing procedures, 
engineering drawings, and engineering or research 
logbooks. 



7.3.4 Design and development review 

At suitable stages, systematic reviews of design and 
development shall be performed in accordance with 
planned arrangements (see 7.3.1) 



a) to evaluate the ability of the results of design and 
development to meet requirements, and 



Participants in such reviews shall include repre- 
sentatives of functions concerned with the design and 
development stage(s) being reviewed. Records of the 
results of the reviews and any necessary actions 
shall be maintained (see 4.2.4). 



to Identify any problems and propose necessary 
actions. 



Participants in such reviews shall include repre- 
sentatives otfuncSons concerned with the design and 
development stage(s) being reviewed, as well as 
other specialist personnel (see 5.5. 1 and 6.2. 1). 

Records of the results of the reviews and any 
necessary actions shall be maintained (see 4.2.4). 



7.3.5 Design and development verification 

(The text of 7.3.5 in ISO 13485 is identical to that in 
the con-esponding subclause of ISO 9001 .] 



7.3.6 Design and development validation 

Design and development validation shall be per- 
formed in accordance with planned arrangements 
(7.3.1) to ensure that the resulting product is capable 
of meeting the requirements for the specified 
application or intended use, where known. Wherever 
practicable, validation shall be completed prior to the 
delivery or implementation of the product. Records of 
the results of validation and any necessary actions 
shall be maintained (see 4.2.4) 



7.3.6 Design and development validation 

Design and development validation shall be per- 
formed in accordance with planned arrangements 
(see 7.3.1) to ensure that the resulting product is 
capable of meeting the requirements for the specified 
application or intended use. Validation shall be 
completed prior to the delivery or implementation of 
the product (see Note 1). 

Records of the results of validation and any 
necessary actions shall be maintained (see 4.2.4). 

As part of design and development validation, the 
organization shall perform clinical evaluations and/or 
evaluation of perfonvance of the medical device, as 
required by national or regional regulations (see 
Note 2). 
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NOTE 1 If a medical device can only be validated 
following assembly and installation at point of use, delivery 
is not considered to be complete until the product has been 
formally transferred to the customer 

NOTE 2 Provision of the medical device for purposes of 
clinical evaluations and/or evaluation of performance is not 
considered to be delivery. 




7.3.7 Controi of design and deveiopment changes 

(The text of 7.3.7 in ISO 1 3485 is identical to that in the 
corresponding subclause of ISO 9001 .] 


7.4 Purchasing 

7.4.1 Purchasing process 

The organization sliall ensure that purchased product 
conforms to specified purchase requirements. The type 
and extent of control applied to the supplier and the 
purchased product shall be dependent upon the effect 
of the purchased product on subsequent product 
realization or the final product. 

The organization shall evaluate and select suppliers 
based on their ability to supply product in accordance 
with the organization's requirements. Criteria for 
selection, evaluation and re-evaluation shall be 
established. Records of the results of evaluations and 
any necessary actions arising from the evaluation shall 
be maintained {see 4.2.4). 


7.4 Purchasing 

7.4.1 Purchasing process 

The organization shall establish documented procedures to 
ensure that purchased product conforms to specified 
purchase requirements. 

The type and extent of control applied to the supplier and 
the purchased product shall be dependent upon the effect 
of the purchased product on subsequent product realization 
or the final product. 

The organization shall evaluate and select suppliers based 
on their ability to supply product in accordance with the 
organization's require-ments. Criteria for selection, 
evaluation and re-evaluation shall be established. 

Records of the results of evaluations and any necessary 
actions arising from the evaluation shall be maintained (see 
4.2.4). 


7.4.2 Purchasing information 

Purchasing information shall describe the product to be 
purchased, including where appropriate 

a) requirements for approval of product, pro 
cedures,, processes, and equipment, 

b) requirements for qualification of personnel, and 

c) quality management system requirements. 

The organization shall ensure the adequacy of 
specified purchase requirements prior to their com- 
munication to the supplier. 


7.4.2 Purchasing information 

Purchasing information shall describe the product to be 
purchased, including where appropriate 

a) requirements for approval of product, pro 
cedures, processes and equipment, 

b) requirements for qualification of personnel, and 

c) quality management system requirements. 

The organization shall ensure the adequacy of specified 
purchase requirements prior to their communication to the 
supplier. 

To the extent required for traceability given in 7.5.3.2, the 
organization shall maintain relevant purchasing 
information, i.e. documents (see 4.2.3) and records (see 
4.2.4). 
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7.4.3 Verification of purcliased product 

The organization shall establish and implement the 
inspection or other activities necessary for ensuring 
that purchased product meets specified purchase 
requirements. 

Where the organization or its customer intends to 
perform verification at the supplier's premises, the 
organization shall state the intended verification 
arrangements and method of product release in the 
purchasing infonnation. 



7.5 Production and service provision 

7.5.1 Control of production and service 
provision 

The organization shall plan and carry out production 
and service provision under controlled conditions. 
Controlled conditions shall include, as applicable 

a) the a^^tTability of Information that describes the 
characteristics of the product, 

b) the availability of work instructions,as necessary, 

c) the use of suitable equipment, 

d) the availability and use of monitoring and 
measuring devices, 

e) the implementation of monitoring and measure- 
ment, and 

the implementation of release, delivery and post- 
delivery activities. 
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7.4.3 Verification of purchased product 

The organization shall establish and implement the 
inspection or other activities necessary for ensuring 
that purchased product meets specified purchase 
requirements. 

Where the organization or its customer intends to 
perform verification at the supplier's premises, the 
organization shall state the intended" verification 
arrangements and method of product release in the 
purchasing infonnation. 

Records of the veiHk;ation\ shall be maintained 
(see 4.2.4). 



7.5 Production and service provision 

7.5.1 Control of production and service 
provision 

7.5. 1. 1 General requirements 

The organization shall plan and carry out production 
and service provision under controlled condi.tipns. 
Controlled conditions shall Include, as applicable 



a) the availability of information that describes the 
characteristics of the product, 

b) the availability of documented procedures, 
documented requirements, work instnictions, 
and reference materials and reference 
measurement procedures as necessary, 

c) the use of suitable equipment, 

d) the availability and use of monitoring and 
measuring devices, 

e) the implementation of monitoring and measure- 
ment, 

f) the implementation of release, delivery and post- 
delivery activities, and 

g) the implementation of defined operations for 
labelling and packaging. 

The organization shall establish and maintain a 
record (see 4.2.4) for each batch of medical devices 
that provides traceabitity to the extent specified in 
7.5.3 and identifies the amount manufactured and 
amount approved for distribution. The batch record 
shall tte verined and approved. 

NOTE A batch can be a single medical device. 
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7.5. 1.2 Control of production and service 
provision — Specific requirements 

7.5. 1.2. 1 Cleanliness of product and 
contamination control 

The organization shall establish documented 
require-ments for cleanliness of product if 

a) product is cleaned by the organization prior to 
sterilization and/or its use, or 

b) product is supplied non-sterile to be subjected to a 
cleaning process prior to sterilization and/or its use, or 

c) product is supplied to be used non-sterile and its 
cleanliness is of significance in use, or 

d) process agents are to be removed from product 
during manufacture. 

If product is cleaned in accordance with a) or b) above, 
the requirements contained in 6.4 a) and 6.4 b) do not 
apply prior to the cleaning process. 

7.5.1.2.2 Installation activities 

If appropriate, the organization shall establish 
documented requirements which contain acceptance 
criteria for installing and verifying the installation of the 
medical device. 

If the agreed customer requirements allow installation 
to be performed other than by the organization or its 
authorized agent, the organization shall provide 
documented requirements for installation and 
verification. 

Records of installation and verification performed by the 
organization or its authorized agent shall be maintained 
(see 4.2.4). 

7.5.1.2.3 Servicing activities 

If servicing is a specified requirement, the organization 
shall establish documented procedures, work 
instructions and reference materials and reference 
measurement procedures, as necessary, for 
performing servicing activities and verifying that they 
meet the specified requirements. 

Records of servicing activities carried out by the 
organization shall be maintained (see 4.2.4). 

NOTE Servicing can include, for example, repair and 
maintenance. 
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7.5.2 Validation of processes for production and 
service provision 

The organization shall validate any processes for 
production and service provision vjfhere the resulting 
output cannot be verified by subsequent monitoring 
or measurement. This includes any processes where 
deficiencies t>econie apparent only after the product 
ts-in use or the service has been delivered. 

Validation shall demonstrate the ability of these 
processes to adiieve planned results. 

The organization shall establish arrangements for 
these processes including, as applicable 

a) defined criteria for reviev/ and approval of the 
processes, 

b) approval of equipment and qualification of 
personnel, 

c) use of specific methods and procedures, 

d) requirements for records (see 4.2.4), and 

e) revalidatiwi. 
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7.5. 1.3 Particular requirements for sterile 
medical devices 

The organization shall maintain rscords of the 
process parameters for the sterilization process 
which was used for each sterilization batch 
(see 4.2.4). Sterilization records shall be traceable to 
each production batch of medical devices 
(see 7.5.1.1). 



7.5JJ Validation of processes for production and 
service provision 

7.5.2. 1 General requirements 

The organization shall validate any processes for 
production and service provision where the resulting 
output cannot be verified by subsequent monitoring 
or measurement. This includes any processes where 
deficiencies become apparent only after the product 
is in use or the service has been delivered. 

Validation shall demonstrate the ability of these 
processes to achieve planned results. 

The organization shall establish arrangements for 
these processes including, as applicable 

a) defined criteria for review and approval of the 
processes, 

b) approval of equipment and qualification of 
personnel, 

c) use of specific methods and procedures, 
d> requirements for records (see 4.2.4), and 
e) revalidation. 

The organization shall establish documented pro- 
cedures for the validation of the application of 
computer sofb»are (and changes to such software 
and/or its application) for production and service 
provision that affect the ability of the product to 
conform to specified requirements. Such software 
applications shall be validated prior to initial use. 

Records of validation shall be maintained (see 4.2.4) 

7.S.2.2 Particular requirements for sterile 
medical devices 

The organization shall establish documented pro- 
cedures for the validation of sterilization processes. 
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Sterilization processes shall tie validated prior to 
initial use. 

Records of validation of each sterilization process 
shall l>e maintained (see 4.2.4). 



7.5.3 Identification and traceability 

Where appropriate, the organization shall identify the 
product by suitable means throughout product 
realization. 

The organization shall identify the product status with 
respect to monitoring and measurement require- 
ments. 

V\ftiere traceability is a requirement, the organization 
shall control and record the unique identification of 
the product (see 4.2.4). 

NOTE In some industry sectors, configuration 
management Is a means by which Identification and 
traceability are maintained. 



7.5.3 Identification dnd b^ceabiJi^ 

7.5.3. f Identification 

TTie organization shall identify the product by suitable 
means throughout product realization, and shall 
establish documented procedures for such product 
identification. 

The organization shall estat^ish documented pro- 
cedures to ensure that medical dewces returned to 
the organization are identi^ed and distinguished from 
conforming product [see 6.4 d)]. 

7.5.3.2 Traceability 

7.5.3.2.1 General 

The organization shall e^ablish documented pro- 
cedures for traceability. Such procedures shall define 
the extent of product traceatiility and the records 
required (see 4.2.4, 8.3 and 8.5). 

Where traceability is a requirement, the organization 
shall control and record the unique identification of 
the product (see 4.2.4). 

W07E Configuration manadement is a means by 
which identification and traceability can be maintained. 

7.5.3.2.2 Particular requirements for active 
implantable medical devices and implantable 
medical devices 

In defining the records required for traceability, the 
organization shall include records of all components, 
materials and work environment conditions, if these 
could cause the medical device not to satisfy its 
spedfied requirements. 

The organization shall require that its agents or 

distributors maintain records of the distribution of 

medical devices to allow traceability and mat such 
records are available for inspection. 

Records of the name and address of the shipping 
package consignee shall be maintained (see 4.2.4). 
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7.S.3.3 Status identification 

The organization shall identify the product status with 
respect to monitoring and measurement require- 
ments. 

The idenmcation of product status sbati be main- 
tained throughout production, storage, installation 
and ser/icing of the product to ensure that only 
product that has passed the required inspecSons and 
tests (or released under an authorized concession) is 
dispatched, used or installed. 


7.5.4 Customer property 

The organization shall exercise care with customer 
property while it is under the organization's control or 
being used by the organization. The organization 
shall identify, verify, protect and safeguard customer 
property provided for use or incorporation into the 
product, if any customer property is lost, damaged or 
othenAfise found to be unsuitable for use, this shall be 
reported to the customer and records maintained 
(see 4.2.4). 

NOTE Customer property can include intellectual 
property. 


7.5.4 Customer property 

The organization shall exercise care with ojstomer 
property while it is under the organization's control or 
being used by the organization. The organization 
shall identify, verify, protect and safeguard customer 
property provided for use or incorporation into the 
product. If any customer property is lost, damaged or 
otherwise found to be unsuitable for use, this shall be 
reported to the customer and records maintained 
(see 4.2.4). 

NOTE Customer property can include inteitectual 
property or confidential health information. 


7.5.5 Preservation of property 

The organization shall preserve the conformity of 
product during internal processing and delivery to the 
intended destination. This preservation shall include 
identification, handling, packaging, storage and 
protection. Preservation shall also apply to the 
constituent parts of a product. 


7.5.5 Preservation of property 

The organization shall establish documented 
procedures or documented work instructions for 
preserving the conformity of product during internal 
processing and delivery to the intended destination. 

This preservation shall include identification, 
handling, packaging, storage and protection. 
Preservation shall also apply to the constituent parts 
of a product. 

The organization shall establish documented 
procedures or documented work Instructions for the 
control of product with a limited shelf-life or requiring 
special storage conditions. Such special storage 
conditions shall be controlled and recorded 
(see 4.2.4). 


7.6 Control of monitoring and measuring 
devices 

The organization shall determine the monitoring and 
measurement to be undertaken and the monitoring 
and measuring devices needed to provide evidence 
of conformity of product to determined requirements 
(see 7.2.1). 

The organization shall establish processes to ensure 
that nfionitoring and measurement can be carried out 


7.6 Control of monitoring and measuring 
devices 

The organization shall determine the monitoring and 
measurement to be undertaken and the monitoring 
and measuring devices needed to provide e\fldence 
of conformity of product to determined requirements 
(see 7.2.1). 

The organization shall establish documented pro- 
cedures to ensure that monitoring and measurement 
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and are carried out in a manner that is consistent with 
the monitoring and measurement requirements. 

Where necessary to ensure valid results, measuring 
equipment shall: 

a) be calibrated or verified at specified intervals, or 
prior to use, against measurement standards 
traceable to international or national measure- 
ment standards; where no such standards exist, 
the basis used for calibration or verification shall 
be recorded; 

b) be adjusted or re-adjusted as necessary; 

c) be identified to enable the calibration status to be 
determined; 

d) be safeguarded from adjustments that would 
invalidate the measurement result; 



can be carried out and are carried out in a manner 
that is consistent with the, monitoring and measure- 
ment requirements. 

Where necessary to ensure valid results, measuring 
equipment shall 

a) be calibrated or verified at specified intervals, or 
prior to use, against measurement standards 
traceable to international or national measure- 
ment standards; where no such standards exist, 
the basis used for calibration or verification shall 
be recorded; 

b) be adjusted or re-adjusted as necessary; 

c) be identified to enable the calibration status to be 
determined; 

d) be safeguarded from adjustments that would 
invalidate the measurement result; 



e) be protected from damage and deterioration 
during handling, maintenance and storage. 

In addition, the organization shall assess and record 
the validity of the previous measuring results when 
the equipment is found not to conform to require- 
ments. The organization shall take appropriate action 
on the equipment and any product affected. Records 
of the results of calibration and verification shall be 
maintained (see 4,2.4). 

When used in the monitoring and measurement of 
specified requirements, the ability of computer soft- 
ware to satisfy the intended application shall be 
confirmed. This shall be undertaken prior to initial use 
and reconfirmed as necessary (see 7.5.2). 



e) be protected from damage and deterioration 
during handling, maintenance and storage. 

In addition, the organization shad assess and record 
the validity of the previous measuring results when 
the equipment is found not to conform to require- 
ments. The organization shall take appropriate action 
on the equipment and any product affected. Records 
of the results of calibration and verification shall be 
maintained (see 4.2.4). 

When used in the monitoring and measurement of 
specified requirements, the ability of computer soft- 
ware to satisfy the intended application shall be 
confirmed. This shall be undertaken prior to initial use 
and reconfirmed as necessary. 



NOTE 
guidance. 



See IS0 10012-1 and IS0 10012-2 for 



NOTE See ISO 10012 for guidance 

measurement management systems. 



related to 



8 Measurement, analysis and 
improvement 

8.1 General 

The organization shall plan and implement the 
monitoring, measurement, analysis and Improvement 
processes needed 

a) to demonstrate conformity of the product, 

b) to ensure conformity of the quality management 
system, and 



L 



c) to continually improve the effectiveness of the 
quality management system. 



8 Measurement, analysis and 
improvement 

8.1 General 

The organization shall plan and implement ttie 
monitoring, measurement, analysis and improvement 
processes needed 

a) to demonstrate conformity of the product, 

b) to ensure conformity of the quality management 
system, and 

c) to maintain the effectiveness of the quality 
management system. 
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This shall include determination of applicable 
methods, including statistical techniques, and the 
extent of their use. 


This shall include determination of applicable 
methods, including statistical techniques, and the 
extent of their use. 

NOTE National or regional regulations might require 
documented procedures for implementation and control 
of the application of statistical techniques. 

Reason for differences: To make the resulting text 
consistent with the objective of reflecting the current 
regulations and facilitating the harmonization of new 
medical device regulations around the world. The 
objective of medical device regulations is the 
maintenance of the effectiveness of the quality 
management system to consistent produce medical 
devices that are safe and effective, not the continual 
improvement of the quality management system. 


8.2 Monitoring and measurement 

8.2.1 Customer satisfaction 

As one of the measurements of the performance of the 
quality management system, the organization shall 
monitor information relating to customer perception 
as to whether the organization has met customer 
requirements. The methods for obtaining and using this 
information shall be determined. 


8.2 lUlonitoring and measurement 

8.2.1 Feedback 

As one of the measurements of the performance of the 
quality management system, the organization shall 
monitor information relating to whether the organization 
has met customer requirements. 

The methods for obtaining and using this information 
shall be determined. 

The organization shall establish a documented 
procedure for a feedback system [see 7.2.3 c)] to 
provide early warning of quality problems and for input 
into the corrective and preventive action processes 
(see 8.5.2 and 8.5.3). 

If national or regional regulations require the 
organization to gain experience from the 
post-production phase, the review of this experience shall 
form part of the feedback system (see 8.5. 1). 

Reason for differences: Both "customer satisfaction" and 
"customer perception" are too subjective for implementation 
as requirements in a regulation. The resulting text is 
consistent with the objective of reflecting the current 
regulations and facilitating the harmonization of new 
medical device regulations around the world. 




8.2.2 Internal audit 

NOTE See ISO 1901 1 for guidance related to quality 
auditing. 

[The text of 8.2.2 of ISO 1 3485 is identical to that of the 
corresponding subclause of ISO 9001 , with the 
exception of the NOTE above.] 
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8.2.3 Monitoring and measurement of processes 

[The text of 8.2.3 of ISO 13485 is identical to that of 
the corresponding subclause of ISO 9001] 



8.2.4 Monitoring and measurement of product 

The organization shall monitor and measure the 
characteristics of the product to verify that product 
requirements have been met. This shall be carried 
out at appropriate stages of the product realization 
process in accordance with the planned arrange- 
ments (see 7.1). 

Evidence of conformity with the acceptance criteria 
shall be maintained. Records shall indicate the 
person(s) authorizing release of product (see 4.2.4). 

Product release and service delivery shall not 
proceed until the planned arrangements (see 7.1) 
have been satisfactorily completed, unless otherwise 
approved by a relevant authority and, where 
applicatile. by the customer. 



8.2.4 Monitoring and measurement of product 

8.2.4.1 General requirements 

The organization siiall monitor and measure the 
characteristics of the product to verify that product 
requirements have been met. This shall be carried 
out at appropriate stages of the product realization 
process in accordance with the planned arrange- 
ments (see 7.1) and documented procedures 
(see 7.5.1.1). 

Evidence of conformity with the acceptance criteria 
shall be maintained. Records shall indicate the 
person(s) authorizing release of product (see 4.2.4). 

Product release and service delivery shall not 
proceed until the planned arrangements (see 7.1) 
have been satisfactorily completed. 

8.2.4.2 Particular requirement for active 
implantable devices and implantable devices 

The organization shall record (see 4.2.4) the identify 
of personnel performing any inspection or testing. 



8.3 Control of nonconforming product 

The organization shall ensure that product which 
does not conform to product requirements is 
identified and controlled to prevent its unintended use 
or delivery. The controls and related responsibilities 
and authorities for dealing with nonconforming 
product shall be defined in a documented procedure 

The organization shall deal with nonconforming 
product by one or more of the following ways: 

a) by taking action to eliminate the detected 
nonconformity; 

b) by authorizing its use, release or acceptance 
under concession by a relevant authority and, 
where applicable, by the customer; 

c) by taking action to preclude its original intended 
use or application. 

Records of the nature of nonconformities and any 
subsequent actions taken, including concessions 
obtained, shall be maintained (see 4.2.4). 



8.3 Control of nonconforming product 

The organization shall ensure tt^t product which 
does not conform to product requirements is 
identified and controlled to prevent its unintended use 
or delivery. The controls and related responsibilities 
and authorities for dealing with nonconforming 
product shall be defined in a documented procedure 

The organization shall deal with nonconforming 
product by one or more of the following ways: 

a) by taking action to eliminate the detected 
nonconformity; 

b) by authorizing its use, release or acceptance 
under concession; 

c) by taking action to preclude its original intended 
use or application. 

The organization shall ensure that nonconforming 
product is accepted by concession only if regulatory 
requirements are met. Records of the identity of the 
person(s) authorizing the concession shall be 
maintained (see 4.2.4). 
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When nonconforming product is corrected it shall tie 
subject to re-verification to demonsfrate cortformity to 
the requirements. 

When nonconforming product is detected after 
delivery or use has started, the organization shall 
take action appropriate to the effects, or potential 
effects, of the nonconformity. 



Records of the nature of nonconformities and any 
subsequent actions taken, including concessions 
obtained, shalt be maintained (see 4.2.4). 

When nonconforming product is corrected it shall be 
subject to re-verification to demonstrate conformity to 
the requirements. 

When nonconforming product is detected after 
delivery or use has started, the organization shall 
take action appropriate to the effects, or potential 
effects, of the nonconformity. 

If product needs to tye reworked (one or more times), 
the organization shall document the rework process 
in a work instruction that has undergone the same 
authorization and approval procedure as the original 
work instruction. Prior to authorization and approval 
of the work instruction, a determination of any 
adverse effect of the rework upon product shall be 
made and documented (see 4.2.3 and 7.5.1). 



8.4 Analysis of data 

The organization shall determine, collect and analyse 
appropriate data to demonstrate the suitability and 
effectiveness of the quality management system and 
to evaluate where continual improvement of the 
effectiveness of the quality management system can 
be made. This shall include data generated as a 
result of monitoring and measurement and from other 
relevant sources. 

The analysis of data shall provide information relating 
to 

a) customer satisfaction (see 8.2.1), 

b) conformity to product requirements (see 7.2.1), 

c) characteristics and trends of processes and 
products including opportunities for preventive 
action, and 

d) suppliers. 



8.4 Analysis of data 

The organization shall establish documented pro- 
cedures to determine, collect and analyse appropriate 
data to demonstrate the suitability and effectiveness 
of the quality management system and to evaluate if 
improvement of the effectiveness of the quality 
management system can be made. 

This shall include data generated as a result of 
monitoring and measurement and from other relevant 
sources. 

The analysis of data shall provide information relating 

to : 

a) feedback (see 8.2. 1), 

b) conformity to product requirements (see 7.2.1), 

c) characteristics and trends of processes and 
products including opportunities for preventive 
action, and 

d) suppliers. 

Records of the results of the analysis of data shall be 
mairitained (sea 4.2.4). 



8.5 Improvement 

8.5.1 Continual improvement 

The organization shall continually improve the 
effectiveness of the quality management system 



8.5 Improvement 



8.5.1 General 



The organization shall identify and implement any 
changes necessary to ensure and maintain the 
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through the use of the quality policy, quality 
objectives, audit results, analysis of data, corrective 
and preventive actions and management review. 



continued suitability and effectiveness of tlie quality 
management system through: thie use of thie quality 
policy, quality objectives, audit results, analysis of data, 
corrective and preventive actions and management 
review. 

The organization shall establish documented pro- 
cedures for the issue <and implementation of advisory 
notices. These procedures shall be capable of being 
implemented at any time. 

Records of all customer complaint investigations shall be 
maintained (see 4.2.4). If investigation determines that 
the activities outside the organization contributed to the 
customer complaint, relevant information shall be 
exchanged between the organizations involved (see 
4.1). 

If any customer complaint is not followed by corrective 
and/or preventive action, the reason shall be authorized 
(see 5.5.1) and recorded (see 4.2.4). 

If national or regional regulations require notification of 
adverse events that meet specified reporting criteria, 
the organization shall establish documented 
procedures for such notification to regulatory 
authorities. 

Reason for differences: To make the resulting text 
consistent with the objective of reflecting the current 
regulations and facilitating the harmonization of new 
medical device regulations around the world. Continual 
improvement of the quality management system is not a 
current objective of regulations. 



8.5.2 Corrective action 

The organization shall take action to eliminate the 
cause of nonconformities in order to prevent 
recurrence. Corrective actions shall be appropriate to 
the effects of the nonconformities encountered. 

A documented procedure shall be established to define 
requirements for 

a) reviewing nonconformities (including customer 
complaints), 

b) determining the causes of nonconformities, 

c) evaluating the need for action to ensure that 
onconformities do not recur, 

d) determining and implementing action needed, 

e) records of the results of action taken (see 4.2.4), 
and 



8.5.2 Corrective action 

The organization shall take action to eliminate the 
cause of nonconformities in order to prevent 
recurrence. Corrective actions shall be appropriate to 
the effects of the nonconformities encountered. 

A documented procedure shall be established to define 
requirements for 

a) reviewing nonconformities (including customer 
complaints), 

b) determining the causes of nonconformities, 

c) evaluating the need for action to ensure that 
nonconformities do not recur, 

d) determining and implementing action needed, 
including, if appropriate, updating documentation 

(see 4.2), 

e) recording of the results of any investigation and 
of action taken (see 4.2.4), and 
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f) reviewing corrective action tal^en. 


f) reviewing the corrective action tal<en and its 
effectiveness. 


8.5.3 Preventive action 

The organization shall determine action to eliminate the 
causes of potential nonconformities in order to prevent 
their occurrence. Preventive actions shall be 
appropriate to the effects of the potential problems. 

A documented procedure shall be established to define 
requirements for 

a) determining potential nonconformities and their 
causes, 

b) evaluating the need for action to prevent 
occurrence of nonconformities, 

c) determining and implementing action needed, 

d) records of the results of action taken {see 4.2.4), 
and 

e) reviewing preventive action taken. 


8.5.3 Preventive action 

The organization shall determine action to eliminate the 
causes of potential nonconformities in order to prevent 
their occurrence. Preventive actions shall be 
appropriate to the effects of the potential problems. 

A documented procedure shall be established to define 
requirements for 

a) determining potential nonconformities and their 
causes, 

b) evaluating the need for action to prevent 
occurrence of nonconformities, 

c) determining and implementing action needed, 

d) recording of the results of any investigations and 
of action taken (see 4.2.4), and 

e) reviewing preventive action tal<en and its 
effectiveness. 
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